Blog

Overview
This post covers installation of v18 openwrt on a Mikrotik RouterBoard 493G or 450G.  Version 18 openwrt is the latest version as of November 2018.  The specific RouterBoard example here is an RB493G, but this procedure will work for most  RouterBoards supported by openwrt.  For example, the procedure to install onto a Mikrotik RB450G is identical to the procedure covered here.  Other openwrt supported RouterBoards models require, at most, only one small change to this procedure (selecting the correct names of the initramfs and sysupgrade .bin files).

Version 18 openwrt made a significant simplifying change to the RouterBoard installation procedure: openwrt now installs and upgrades directly from the LuCI web interface of openwrt.  This means the procedure to install openwrt on a Mikrotik RouterBoard is now just two steps:

• Step 1. Temporarily install openwrt into the RAM of the RouterBoard by using the RouterBoard's ability to boot from an Ethernet network (netboot).
• Step 2. Use the temporarily-installed Ram-based openwrt to run the openwrt LuCI web page that installs/upgrades openwrt directly into the flash memory of the Routerboard.

Step 1 and 2 are essentially identical for all RouterBoard models,  with the primary difference being the selection of the specific initramfs (Step 1) and sysupgrade .bin (Step 2) file names to download from the openwrt website. See the
Mikrotik Table of Hardware - Firmware Downloads
for the specific file names to be used for any of the openwrt supported Mikrotik RouterBoards.   The RB493G and RB450G use the exact same file names.

Another simplifying change to the installation procedure of openwrt is my recommended use of the Windows freeware software package 'Tiny PXE'.  Used during Step 1, Tiny PXE allows the use of the default Mikrotik BOOTP netboot protocol without any changes to the RouterBoot setup.  This means that a serial connection to the RouterBoard is no longer absolutely necessary since a RouterBoard can be forced to netboot by simply pressing and holding its Reset button when powering up.

Tiny PXE is such a simplifying solution to the netboot of Mikrotik RouterBoards that I have since modified the openwrt wiki to reflect the suggested use of Tiny PXE.  In the former openwrt wiki documentation, you would set up some kind of a temporary DHCP/BOOTP/TFTP server by picking from a list of alternatives that were text and Linux oriented.  Tiny PXE removes the complexity of DHCP/BOOTP/TFTP setup with its very simple Windows 'portable' standalone application that is well suited to the RouterBoards since Tiny PXE so easily supports the default BOOTP boot protocol of RouterBoot.  Much credit needs to be forwarded to its author for providing such a handy and well-implemented netboot tool.

Background  
    Is the Mikrotik RB493G  the  Ultimate openwrt Router?
We recently upgraded our cable modem to a DocSis 3.1 compatible unit, the Motorola MB8600.  DocSis 3.1 offers substantially lower latency internet access: web pages begin to download noticeably faster with this new cable modem.  Our download speeds with this new cable modem are now measuring in excess of 100 MBits - which appears to be very near the limit of our existing TpLink TL-WR1043ND router's WAN capabilities.  As Comcast continues to improve our download speeds, we want to be sure we have a router that can keep up.

We have also upgraded all our PCs here to Windows 10 laptops with USB3.0 ports that support up to 5 GB/S speeds.  Our PCs now use USB3.0 to gigabit Ethernet adapters to connect to our wired Ethernet, or a Thunderbolt 3 docking station to 'permanently' connect to wired gigabit Ethernet.

We've been running openwrt on our TpLink router for the last few years and have had zero crashes of the router: openwrt is phenomenally reliable.  I have experience with a number of router brands through my industrial networking installations business: Cisco, Linksys, Netgear, ZyXel, Mikrotik, TPLink, Ubiquiti, etc. and have found I prefer the simplicity, reliability and cutting edge features of openwrt over all the various brands I have used.

So our small office is now characterized by:

• Gigabit PCs
• Gigabit switch
• A low latency, high bandwidth Internet cable modem that is in excess of 100 MBit Ethernet capabilities.
• A router with five 10/100/100 Ethernet ports that seems to be having trouble utilizing our DocSis 3.1 router's speed, and just does not have enough gigabit ports for my needs: I am tired of plugging and unplugging computers while I am working on them.

It's time to upgrade our router.  The features we would like:

• openwrt compatible (on the openwrt hardware compatibility list)
• Eight or nine 10/100/1000 Ethernet ports
• 2.4/5GHz WiFi. 802.11 a/b/g/n
• 802.1Q Trunking VLAN support for segregated (guest) LAN & WiFi networks
• FQ_CoDel Smart Queue Management (SQM) to take advantage of the DocSis 3.1 extremely low latency capabilities
• Desktop size (not rack mount)

This list above yields one candidate: the Mikrotik RB493G.  I have been using the Mikrotik hardware (and RouterOS software) for years in my industrial installations and found their hardware to be extremely robust.  That only makes sense since many of the Mikrotik routers are installed in outdoors applications: these are indeed high quality routers.

The Mikrotik RB493G is a highly capable small router with a 680 MHz MIPS processor, 256MB RAM and 128MB NAND flash. It has a serial port, SD card slot, will run from a 8-28V DC supply and is rated for -40 to +70 degrees C.  They are designed to be used in some pretty challenging outdoor environments so they are robust.  They ship with a proprietary Mikrotik OS that has a surprisingly full feature set for router applications. These routers give Cisco a run for their money at a fraction of the cost. The irony of the full feature set is that this router is difficult to learn: we simply don't need most of the features and their immense routing flexibility is not used for home, small office or industrial applications.

We could just install a stock RB493G with the optional 2.4/5GHz R52HnD WiFi, leaving the stock RouterOS on the RB493G.  However, in spite of using the Mikrotik routers for years, I've never been able to warm up to the extremely complex RouterOS.  I generally spend way too long trying to implement any new feature on RouterOS so I would prefer that our office router runs on openwrt.  Openwrt is remarkably simple to configure and modify for just about any scenario you can dream up.

VLAN Support on the RB493G and RB450G
Many of the articles here on this website discuss setting up a segregated guest WiFi network.  Because our applications all use VLANs, it is imperative that we select a router with 802.1Q Trunking VLAN support.

The Atheros AR8316 switch chips on the RB493G (one AR8316 on the RB450G, two AR8316's on the RB493G) do support 802.1Q Trunking with version 18 of openwrt.  802.1Q Trunking allows us to map one untagged VLAN and multiple tagged VLANs onto a port: a required feature when creating a guest LAN or WiFi network.

However, the AR8316 chips do NOT support VLAN 'hybrid' switching (sometimes called 'general' switching in some managed switches), but that is a feature of little import in our router configurations.  If our router was serving numerous VLANs where we needed routing between VLANs at wire speeds, then 'hybrid' switching would be handy to speed up communication across VLANs.  However, since we run each of our VLANs through the router CPU for firewalling purposes anyhow,  there is nothing to be gained by 'hybrid' switching for any of our applications here in our small office.

V18 openwrt Installation Procedure on the Mikrotik RB493G
You can find the openwrt build instructions wiki for the Mikrotik Routerboard 493G here:
https://openwrt.org/toh/mikrotik/rb493g

And the openwrt Common Procedures for Mikrotik Routerboard Products wiki here:
https://openwrt.org/toh/mikrotik/common

I wrote much of the the above openwrt version 18 Mikrotik documentation (see the above links).   So you will see many similarities in this document and the openwrt wiki.  However, the openwrt wiki information pages are mostly text, whereas these instructions here contains LOTS of screen shots.  My instructions here are Windows 10 oriented and reflect the much simpler, newer 'sysupgrade' style images of version 18 openwrt.  I've been using Unix and Linux for 25+ years but my daily machine is my Windows 10 laptop. Virtually every form of Industrial software runs from Windows so that's my first line of defense for my paying jobs.  My apologies to the Linux fans: I love Linux, but I'm really familiar with Windows 10 by virtue of professional necessity.

My main computer is a Windows 10 64 bit laptop with its maximum 16GB RAM and a 2 TB flash drive.  You will NOT need a very high end PC to accomplish this openwrt installation: pretty much any Windows 10 (or Windows 7) laptop/PC should be able to perform this installation.

Step 1 - Gather/Purchase All the Hardware You Will Need
In our example, we will be using the following equipment:

• Mikrotik RB493G circuit board
• Mikrotik R52HnD miniPCI 2.4/5GHz WiFi card
• Quantity 2 Mikrotik ACSWIM 2.4/5GHz antennas with MMCX connectors
• Mikrotik CA493 case
• Mikrotik compatible 'wall wart' power supply such as the Maxxwave 24V 24W
• An Ethernet cable to connect from your existing router to the RB493G.  We will use this same cable to also connect from the RB493G to your laptop/PC.  It needs to be long enough to conveniently connect to your existing router (or switch) and the RB493G: I use a 7 foot Ethernet cable.

If you don't want to assemble the above RB493G parts yourself, you can purchase a fully assembled RB493G with the above WiFi card directly from Baltic Networks.

Optional Hardware  Only needed to connect to the serial port to view console or change boot settings of the RB493G.  This is handy to debug the success of your netboot, but is not absolutely required when you use the TinyPXE software described in this document.

• A USB to serial RS232 adapter.  We will use this to connect our PC to the serial port on the RB493G.  There are many choices of USB to RS232 adapters available, however I can highly recommend the Tripp Lite Keyspan USA-19HS.  I use it in my industrial PLC business: this has a Windows software driver proven to be compatible with a large number of software packages that require RS232 serial support.  This device is only used while we are installing openwrt.
• A null modem RS232 serial DB-9 female to DB-9 female adapter. 
  This device is only used while we are installing openwrt.

Step 2 - Download the Needed Files
In my case, I had purchased my RB493G quite some time ago, so it was running a very old version (V5.2) of RouterOS.  Because we are careful to save the existing RouterOS license before starting any of the installation of openwrt,  we need to run the Mikrotik Windows App 'WinBox' to save the existing License File (this cannot be done using the Mikrotik 'WebFig' web-based interface).

However, if you have an old version of RouterOS, the WinBox Windows application is not compatible with Windows 10.  So, ironically, we need to start off by updating the RouterOS to the latest version in order to get an updated WinBox that will work with Windows 10.  Note: you cannot just download WinBox from the Mikrotik webpage because old versions of RouterOS will not necessarily work with newer versions of WinBox.

Step 2A - Download the Latest Mikrotik RouterOS for the RB493G
We will begin by downloading the latest version of RouterOS into the Downloads folder of our PC, so we can later upload RouterOS onto the RB493G.  Go to Mikrotik.com in your browser, then click on 'Software'.  This will bring you to a list of RouterOS versions available to download.  Select the latest long term version for a MIPSBE architecture device (RB4xx) and download that to your PC's Downloads folder:

Step 2B - Download the openwrt Images for the RB493G
The current releases (as of November 2018) of the openwrt images for the RB493G are located at:
http://downloads.openwrt.org/releases/18.06.1/targets/ar71xx/mikrotik/

You will need just two files from that archive:

1. openwrt-18.06.1-ar71xx-mikrotik-vmlinux-initramfs-lzma.elf
2. openwrt-18.06.1-ar71xx-mikrotik-nand-large-squashfs-sysupgrade.bin

If you are working on an RB450G, it uses the exact same two files. 

The initramfs file is used temporarily to initially boot the RB493G into openwrt during installation.   The sysupgrade.bin file contains the full image that will be permanently stored in the NAND flash of the RB493G.

If you are working on a RouterBoard other than the RB493G or RB450G, the above filenames may be different.  See the
Mikrotik Table of Hardware - Firmware Downloads
for the specific file names to be used for any of the openwrt supported Mikrotik RouterBoards.   

Step 2C - Download a Copy of Tiny PXE
Tiny PXE is a very small DHCP/BOOTP/TFTP Server that we will run on our Windows 10 PC to install openwrt on the RB493G.  It is freeware that can be freely downloaded.  It does not need to be installed into Windows since it is a 'portable' application that can simply be run from the folder where it was downloaded.  Download it from:

http://reboot.pro/files/file/303-tiny-pxe-server/

After downloading the pxesrv.zip file, unzip it into a known location (such as your Downloads folder).  This will create a folder named 'pxesrv' in your Downloads folder.

Step 2D - Download and Install a Copy of PuTTY
This software is optional: it can be skipped, but will leave you blind to the netboot process on the RB493G.  PuTTY is a freeware Windows terminal program we will use to login to the debug RS232 serial terminal of the RB493G.  Download and install the appropriate (32 bit or 64 bit, depending on your Windows OS) .msi file from:

https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html

We now have a total of 3 files and one folder that we have stored in our PC's Downloads folder that will we use to perform the upgrade:

1. routeros-mipsbe-6.42.9.npk - the latest Mikrotik RouterOS (includes WinBox)
2. sysupgrade.bin - the permanent version of openwrt for the RB493G
3. initramfs-lzma.elf - the temporary version of openwrt used to install openwrt
4. The pxesrv folder that contains the pxesrv.exe file (Tiny PXE). 

Step 3 - Reset the RB493G to Its Default Settings
Connect an Ethernet cable from your existing switch/router to the ether1 port of the RB493G (ether1 is the single Ethernet port between the power conenctor and the serial connector), find the reset button on the RB493G (between the serial connector and the ether1 connector), depress the reset button (use a pencil), and apply (connect) power to the RB493G.  Continue to hold the reset button depressed for at least 10 seconds immediately after connecting power, until the green light extinguishes: this will erase all prior setup in the RB493G and configure it to the default RB493G settings.

Be patient: this takes quite awhile to complete once the green light extinguishes.  You will eventually see all the lights flash on the ethernet ports, then settle out.  The two ethernet lights on the ether1 port connector will finally start flashing from activity on your network.

Step 4 - Configure Your Laptop/PC Ethernet to Talk to the RB493G
These instructions presume you have already connected an Ethernet cable from your existing ethernet network into the ether1 port of the RB493G and the RB493G is powered on.  Please note the default setting of the RB493G does NOT enable a DHCP server or client on any of the Ethernet ports:  only the ether1 port can be accessed (without DHCP), and only at the default Mikrotik IP address of 192.168.88.1.  With the default RB493G settings, no other Ethernet ports are active on the RB493G.

These instructions presume your existing router is set up to provide DHCP to any PC connected to your network.  However, these instructions presume your existing router uses some IP address range other than 192.168.88.X (the default IP address range used by Mikrotik) or 192.168.1.X (the default IP address range used by openwrt).

Since neither DHCP client or server is enabled on the RB493G, your PC will NOT be able to talk to the RB493G until your PC is setup to access the 192.168.88.X network.  You therefore need to reconfigure your Windows 10 PC Ethernet settings so your PC's Ethernet is talking to BOTH your local network and the RB493G.

In addition, we want to prepare for the default IP address range of openwrt so we can easily plug into the ether2-ether9 ports during the openwrt installation.  Openwrt will initially install the RB493G at IP address 192.168.1.1 so we will also set up the PC's Ethernet card to access the 192.168.1.X address range.

To review, we will now set up our PC/laptop Ethernet 'card' to have 3 simultaneous IP addresses at once:

• The same address our PC/laptop had originally on our existing Ethernet network.
• An address compatible with the default Mikrotik RouterOS  192.168.88.1 address on ether1.
• An address compatible with the default openwrt 192.168.1.1 address on ether2 - ether9.

Windows 10 will allow a network card to be at multiple IP addresses at the same time.  However, in order to use this feature, only hardwired IP addresses can be used on that network card: DHCP cannot be used with multiple IP addresses.

Open a command prompt window in Windows: go to Windows Start->Windows System->Command Prompt.

Type in the command 'ipconfig'.  You will see results similar to:

Note the 'IPV4 Address' in the above output from ipconfig: my Ethernet port is set (by DHCP) to an address of 10.32.147.20.  Your PC's Ethernet will assuredly be at a different address than this.  We will now change the Ethernet port settings to force the Ethernet port of my PC to 10.32.147.20 (instead of getting it from DHCP).  We will also give it an IPV4 address of  of 192.168.1.10 (for openwrt) and 192.168.88.10 (for RouterOS). 

Open Windows 10 Network Connections: press the Windows Button on your keyboard, plus the 'R' key.  This will open the Windows Run popup.  Type ncpa.cpl, then press OK:

Right click your Ethernet connection, press Properties.  This will bring up Ethernet Properties, then click on 'Internet Protocol Version 4 (TCP/IPv4), then the Properties button:

Click on the 'Use Following IP Address' and 'Use Following DNS Server Address' radio buttons to hardwire the primary IP address of your PC's Internet.  Use the same IP addresses that you saw from the earlier 'ipconfig' command (see above, but use YOUR IP addresses, not those shown here)

Now click on the 'Advanced' button, then the 'Add' button of 'IP Addresses'.  Enter the same IP address 192.168.1.10 shown here:

Press Add, the press Add again so we can add the next IP address 192.168.88.10 shown here:

Press Add.  You will now have 3 IP addresses listed in the 'IP addresses' box above: your original IP address, 192.168.1.10, and 192.168.88.10.

Press OK, then OK, then Close to get out of the IP address settings of Windows 10.

If you run ipconfig again in your command window, you will now see that your Ethernet has three simultaneous IPV4 addresses assigned:

Step 5 - Backup the RB493G License Before You Overwrite Anything
Before you remove the existing RouterOS from the RB493G (by replacing with openwrt), you should consider saving the RouterOS license file in case you'd like to re-install RouterOS at a later date.

We'll use the Mikrotik winbox app to save the exisiting RouterOS license.  Note you cannot use the Mikrotik 'webfig' web interface to save the license: only the stand-alone Windows application  'winbox' contains the feature to export your Mikrotik license file.

It is best to download a copy of winbox onto your PC by using the web interface of webfig to get a copy of winbox.  Do not load a copy of winbox off the Internet since that may not be compatible with the RouterOS version running on the RB493G.

Now that our PC is capable of talking to the 192.168.88.X network, we will use a web browser, such as Chrome, to access the built-in 'webfig' web pages of the RB493G router.  Enter the URL '192.168.88.1' into your web browser:

The default login is 'admin' and the password is empty.  Press the Login button to enter the WebFig pages.

Step 5A - Load the Latest RouterOS Into the RB493G
Now that you are in Mikrotik 'webfig', click on Files, then Choose File, then navigate to the Downloads folder on your PC where you stored the latest version of RouterOS that you previously downloaded from the Mikrotik website (see Step 2A above), then Open the routeros file.

Once the upload completes, click on 'System' then 'Reboot' in WebFig.  This will reboot the router and install the newest version of RouterOS.

The RB493G will reboot and take quite a few minutes to write the new RouterOS image into the NAND of the RB493G.  Be patient and wait until the RB493G has rebooted a couple times and you can once again log into 192.168.88.1.  Do NOT power off the RB493G.

Step 5B - Use WinBox to Export the License Key
Once the RB493G has fully updated and rebooted, do NOT login.  Instead, click on 'Winbox' in the WebFig login .  This will save a copy of WinBox to your Downloads folder on your PC.

Use Microsoft File Explorer to go to your Downloads folder and click on Winbox.exe.  This will open the Winbox Windows application to its login page.  Enter 'admin' as the Login, with no password, then press Connect:

Once you are in WinBox, press 'System', then 'License', then 'Export Key' to save your license to a file in the Downloads folder of your PC:

If you do need to re-install RouterOS again, it is a fairly easy process to use Mikrotik's netinstall utility.  Please refer to our post: Using Mikrotik netinstall to install RouterOS.

Step 6 - Configure and Connect to the RB493G Serial Port
This step is optional, but highly recommended so you can view what is happening on the RB493G serial port console terminal.

Attach the Tripp Lite Keyspan USA-19HS RS232 Adapter to your laptop's USB port and the serial port of the RB493G.  You will need to use a null modem adapter to connect the USA-19HS DB-9 serial connector to the RB493G DB-9 serial connector (see the Step 3 picture above).

When the USA-19HS is first attached to the USB port of your PC, Windows 10 will automatically download and install a driver for the device - so it's important to perform this initial installation while your laptop is still connected to the Internet.  If you are running Windows 7 or earlier, you may need to manually download and install the USA-19HS driver from the Internet.

The USA-19HS adapter will be installed to one COM port of your PC: pay attention during installation since you will need to use that precise COM port to set up putty.  

If you did not notice the COM port that the serial adapter is associated to, you can use the Windows Device Manager to verify exactly which COM port is associated with the USA-19HS.  Press the Windows Key, then the 'R' key, then type 'devmgmt.msc':

Scroll down to Ports in the Device manager to determine which COM port is associated with the USA-19HS:

In this case, we can see above that Windows installed the USA-19HS at COM port 5.  This is the COM port we will use to set up PuTTY.

Now go to Windows Start->Putty and open the Putty application.  Click on the 'Serial' radio button in the PuTTY Configuration popup:

Note we have not yet configured the correct serial settings in the above screen shot: the COM1 'Serial line' is the wrong COM port, and the 'Speed' should be 115200.  So under the left-hand 'Category' list, click on 'Serial'.  This will bring you to the screen to configure the serial settings:

Set the serial line to the COM port you noted above from the Windows Device Manager (COM5 in our example above).  Baud is 115200, no parity, 1 stop bit, 8 bits and no flow control.

Press the Open button to open a PuTTY terminal window in Windows.  You will see a (blank) window like:

Move your cursor to the PuTTY terminal window and press the Enter key on your keyboard.  You will get a prompt for the MikroTik login, such as:

To prove that PuTTY is accepting keyboard input successfully, type in 'admin' as the Login and press Enter for the Password (no password).  You will get the MikroTik serial port login page:

Step 7 - Run TinyPXE
The RB493G will optionally use the Preboot Execution Environment (PXE) to boot an image from the network.  This ability to boot an image from the network (PXE) is the method used to install openwrt.

PXE consists of three distinct software packages that are individually served up by an existing device (such as a router) on a network:

• A DHCP (Dynamic Host Control Protocol) server that provides a booting PC (the RB493G) with an IP address to use on the local network.  DHCP is likely used by every device connected to your network: most devices get their IP address from the DHCP server on the local network (your router).
• A BOOTP (Boot Protocol) server that provides a booting PC (the RB493G) with the name and location of the network image file to get over the network.  BOOTP is only used by PXE devices connected to your network (likely ONLY the RB493G), and only used for the short period of time that those devices are booting.
• A TFTP (Trivial File Transfer Protocol) server that sends the network image file to the booting PC.  TFTP can be used to transfer files between devices in other situations, however your Windows PCs are using their own built-in protocols (other than TFTP) to perform all file transfers on your network.  So for all practical purposes, TFTP is only used by PXE devices connected to your network (likely ONLY the RB493G), and only used for the short period of time that those devices are booting.  

Virtually all routers offer the ability to serve DHCP, however many (home) routers do not have BOOTP or TFTP capabilities.

In order to download the new openwrt image to the RB493G, we will need an existing device on the network that serves up all three protocols above.

Since there are an endless number of routers that may already exist on a network, and the instructions to set up DHCP, BOOTP, and TFTP all vary from one router to another, we will instead temporarily disconnect our laptop from our local network, connect an Ethernet cable between our laptop and the RB493G, and run a small piece of software that will provide DHCP, BOOTP, and TFTP while we download the image to the RB493G.

There are multiple choices of PXE environments that will run on a Windows 10 PC, such as tftpd32, serva and tinyPXE.  TinyPXE is free, has full support for the BOOTP style netboot (unlike the other options listed above) and is very simple to use: perfect for this application.

Step 7A - Download and Unzip TinyPXE
See Step 2C above for details on installing Tiny PXE (pxesrv.exe).

Step 7B - Modify the TinyPXE Config File to Enable RFC951 (BOOTP)
Use an editor such as notepad to edit the TinyPXE config.ini file.  The config.ini file is located in the same folder as the TinyPXE executable (pxesrv.exe).  Scroll down below the [dhcp] section of the confiig.ini file and add the following line anywhere in the [dhcp] section:

rfc951=1

Following is an example of the top section of a modified TinyPXE config.ini file.  The [dhcp] section identifier and two added lines for the Mikrotik are highlighted below.  Note the first line added is a comment (starts with ';'):

Step 7C - Disconnect Ethernet Cables from Your Existing Router/Switch
Before we run Tiny PXE, it is VERY important to isolate your PC/laptop from your existing network and ensure your laptop is ONLY connected to the ether1 port of the RB493G.  Since your existing network already has a DHCP server running, you cannot run a second DHCP server on the same network: the two DHCP servers will compete with each other and result in an unstable network setup.  Do NOT start Tiny PXE until you have rewired your Ethernet cables to isolate the laptop from your existing network.

So we will now isolate the laptop and RB493G from the rest of the network by disconnecting the laptop and RB493G from your existing network.  After removing the Ethernet cables from the RB493G and your laptop/PC, connect an Ethernet cable from your laptop/PC directly to the RB493G ether1 port.  Make sure the WiFi is off on your laptop too.

Step 7D - Start pxesrv.exe
Use Windows Explorer (press the Windows button on your keyboard plus the 'E' key) to go to the pxesrv folder in your Downloads folder.  Click on the pxesrv.exe file to start up Tiny PXE.  Windows and/or your antivirus may ask about running the application and modifying the firewall: be sure to respond yes to any requested changes.

The Tiny PXE Startup window will automatically select any one of your connected Ethernet interfaces.  Note below that I have selected the 192.168.88.10 interface (the Mikrotik interface) as the interface to run the DHCP server (not absolutely necessary, but makes the most sense):

Select the previously downloaded (in Step 2B) openwrt vmlinux-initramfs-lzma.elf file that we will netboot into the RB493G:

Disable (uncheck) the 'Filename if user-class=gPXE or iPXE'.
And finally, start TinyPXE by pressing the 'Online' button:

Note that after Tiny PXE was put online in the above example, a successful DHCPd:ACK and TFTPd DoReadFile occurred: the RB493G booted from the initramfs-lzma.elf file.  This will occur as soon as we enable the RB493G for a network boot from DHCP (the next step).

If you cannot get TinyPXE to work (if you can't get TinyPXE to recognize the booting RB493G in the next step), the first thing to check is your firewall settings.  It is highly advisable to try temporarily turning off your firewall if you have any problems here.

Step 8, Option 1 - Boot the RB493G from the Network Using Reset Button
The simplest method to boot the RB493G from the network is to hold the RB493G reset button immediately after powering up the RB493G.  When the reset button is pressed at powerup, the default settings of the RB493G RouterBoot will first attempt to run BOOTP, then boot from NAND flash if the BOOTP netboot fails.

Therefore, since we have enabled rfc951 BOOTP netboot in TinyPXE above, all we need to do is to power off  (unplug) the RB493G, hold the reset button, then power on (plug in) the RB493G.  After a few seconds (continue to hold the reset button after plugging power in), the RB493G will begin checking for a BOOTP/TFTP server.

Step 8, Option 2 - Configure the RB493G to Boot from the Network using DHCP
This method of booting from the network is required if NOT using rfc951 BOOTP netboot (a TinyPXE config.ini option), but instead using DHCP/BOOTP netboot.  If using DHCP/BOOTP instead of rfc951 BOOTP, we need to use the serial console to modify the Mikrotik RouterBoot settings to boot exclusively from the network, and to use DHCP boot protocol instead of the BOOTP boot protocol.

Unplug the power to the RB493G, wait a couple seconds, then plug the power in. This will reboot the RB493G.

You'll have a couple seconds to press any key after the reboot.  This is not much time, so I recommend moving your cursor to the PuTTY window in advance so the PuTTY terminal window has focus and your keyboard input will then go to PuTTY (the RB493G).

Here we are in Putty after we pressed a key within a couple seconds of the RB493G bootup:

Now we want to convince the RB493G to quit booting from its flash (called NAND) and instead boot from the Network. Press 'o', then 'e'. Press 'o' again to see if you were successful at getting the Ethernet selected as our boot source: we should see the 'e' as the highlighted selection. The Enter key will exit this submenu.

And we also want the RB493G to use DHCP (PXE boot) instead of BOOTP when it is booting from the network. Press 'p', then '2'. Press 'p' again to verify your success. The Enter key will exit this submenu.

Press 'x' (exit setup) to save your settings and reboot the RB450G.

Now the RB493G is patiently waiting to boot from the network. 

Step 9 - The Download of the openwrt initramfs File Starts and Completes
Once the DHCP/BOOTP/TFTP TinyPXE server is running and the RB493G has been enabled for network boot, the netboot of the initramfs file will begin immediately.  This is the serial console output during the netboot of openwrt (assuming you have a serial adapter connected to the serial console):

Step 10 - Perform openwrt SysUpgrade to Permanently Write to NAND
At this point, the RB493G is now running a temporary copy of openwrt: it is only in the RB493G RAM and has not yet been permanently written to the RB493G NAND flash.  If we power down the RB493G, the openwrt currently in RAM will be lost and we will once again need to load the initramfs file into the RB493G using TinyPXE.

We will use this temporary version of openwrt to perform a 'SysUpgrade' that permanently writes the sysupgrade.bin file into the RB493G NAND flash.  This step is irreversible: the Mikrotik RouterOS will be permanently erased from the NAND flash.

In order to login to openwrt, our laptop now needs to be plugged into any of the ether2 through ether9 ports. 

Disconnect the Ethernet cable from the ether1 port and reconnect to any of the ether2 - ether9 ports.

Enter the IP address 192.168.1.1 into your web browser URL to login to openwrt:

Press the Login button and go to System->Backup/Flash Firmware:

Press the Choose File button and select the sysupgrade.bin file that you saved to the Downloads folder in Step 2B:

Press the Flash Image button:

Press the Proceed button after verifying the .bin file details:

While flashing, you will see the following screen, and then the RB493G will automatically reboot.  Watch the PuTTY serial port to know when the flashing has completed since the following screen will not change:

Step 11 - Reconfigure the RB493G to Boot from NAND
If you used Step 8, Option 2  where you reconfigured the MikroTik RouterBoot to always boot from the network, you now need to revert that setting back to its default value to boot from NAND.  If you instead used Step 8, Option 1 and simply held the reset button to force a BOOTP netboot, you will not need to perform this final configuration change step here.

After you have seen the RB493G automatically reboot on the PuTTY screen after the preceding firmware flash, the RB493G will once again try to boot from the Network (assuming you used Step 8, Option 2).

We now need to tell the MikroTik RouterBoot to start booting from NAND again: there is no longer any need to boot from the network.

Unplug the RB493G power, wait a couple seconds, then plug the power in. This will reboot the RB493G.

You'll have a couple seconds to press any key after the reboot.  This is not much time, so I recommend moving your cursor to the PuTTY window in advance so the PuTTY terminal window has focus and your keyboard input will then go to PuTTY (the RB493G).

Now we want to reset the RB493G to boot from NAND flash. Press 'o', then 'n'. Press 'o' again to see if you were successful at getting the NAND selected as our boot source: we should see the 'n' as the highlighted selection. The Enter key will exit this submenu.

Press 'x' to exit setup.  You are done.  Congratulations!

This article is one of a multi-part series on setting up a segregated Guest Network, including a guest WiFi network, within a Home Network.  It is essentially an introduction to Virtual Local Area Networks ( VLAN), provides a simple use case for VLANs and gives a complete set of recommended hardware plus details the setup of that hardware.

The series of Guest Network articles progresses as follows:

1. We select a set of low cost hardware to meet  our criteria of creating a Guest Network, including Guest WiFi, within our Home Network.
2. We go into some detail why we use VLANs and a managed switch.  Understanding VLANs is key to understanding how to build a guest network.
3. We set up the TPLink TL-WA801N WiFi Access points.  This is a very simple process where configure each AP onto our Home Network and configure the AP's WiFi to operate on our separate Guest Network VLAN.
4. We set up our managed switch, a Cisco Linksys SG300-10P, to send Home Network traffic to only the Home Network devices and Guest Network traffic to only the Guest Network devices.  And we show the special case of mapping the Guest Network Access Points onto both networks simultaneously.
5. We begin preparing our main router, a TPLink TL-WR1043ND, to create and manage the VLAN traffic for our Home Network and our Guest Network.  Since the WR1043ND does not come with 802.1q VLAN support out of the box, this article is where we install openwrt on the WR1043ND.
6. Lastly, we configure openwrt on the TPLink TL-WR1043ND to create and manage all the VLAN traffic.

In this final article of the series, Part 6, we configure openwrt of the TPLink TL-WR1043ND with the VLANs we need to create and maintain our separate Guest Network and Home Network.

VLANs to Be Used

• VLAN1.  The home network at 10.32.147.X.  These devices are all our personal devices include laptops, desktops, phones, printers, etc.
• VLAN2. On the TPLink WR-1043ND router, VLAN2 is the WAN port.  This is connected to a cable modem in our case.
• VLAN4. This is the guest network at 10.32.148.X.

The above network diagram shows how we defined the ports on our Cisco Linksys SG-300-10P Power Over Ethernet (PoE) managed switch in a previous article.

Our guest WiFi Access Point, configured in a previous article in this series, is shown in the upper right hand corner.  This Access Point will hand out WiFi IP addresses in the guest network range of 10.32.148.X.  To make it easy to configure the Access Point from our home network, we put the AP's web configuration page on our home network with the 10.32.147.X range.  This will prevent guests from being able to modify the AP settings.

If you have the version 2.X hardware, it uses an Atheros AR8327N switch chip instead of the Realtek RTL8366rb that is used in the V1.X hardware.  It appears from the documentation of openwrt ticket #12181 that the 'Barrier Breaker' V14.07 Stable image for V2.X hardware does NOT have the 802.1q VLAN support.  If your VLANs do not work with V2.X hardware, please check the status of openwrt ticket #12181 and use the appropriate version of openwrt.  So buying V1.X hardware might be easier 🙂

Login to Openwrt

Once the firmware upgrade is complete, you will see the front panel lamps on the WR1043ND light up with the SYS lamp on steady.  Re-enter the IP address 192.168.1.1 in your browser.

The default user name is 'root' and there is no password at first login.  Complete the login and create a new password, as prompted.

Setup WAN Interface in Openwrt

Go to Network->Interfaces.  Click on WAN.  Following is a shot of my WAN setup.  It required no changes since my WR1043ND plugs into a cable modem that has its own DHCP server.  So the WR1043ND is simply a DHCP client on its WAN port.

Please note there is considerable documentation on the openwrt WR1043ND web page about the  'WAN Port Disable' bug.  I DID NOT experience this problem, however I thought I did!  My Comcast Docsis 3 cable modem is very picky about replacing the router connected to the cable modem: it will not allow a new device to be plugged in without repowering the cable modem.  So once I connected the WR1043ND to the cable modem and cycled the power on the cable modem, the WR1043ND WAN port picked up an IP address from the cable modem and began working fine.

Verify your WAN port is connected before continuing: you should see the uptime increment in the above screen.

Setup LAN Interface in Openwrt

Go to Network->Interfaces.  Click on LAN.  Following is a shot of my LAN setup.

Referring to the network diagram at the beginning of this article, we set up the LAN to  have the router at 10.32.147.1, the mask to 255.255.255.0 (maximum 254 addresses on LAN), and the DHCP to provide addresses from 10.32.147.100 through 10.32.147.149 for our main home network devices.

Setup VLAN4 Interface in Openwrt

Go to Network->Interfaces.  Click on 'Add New Interface' and create a new VLAN named VLAN4 on eth0.4.

Your screen will not have the already existing VLAN Interface "etho.4" as shown above (the fourth radio button down in the 'Cover the following interface' list).  You will click on 'Custom Interface' and enter 'eth0.4' to create the interface (as shown).

Note that we are NOT creating a bridge here (do not check the 'Create a bridge over multiple interfaces' checkbox): we want the VLAN4 guest network to be completely standalone.

Setup of VLAN4 is very similar to the interface 'LAN'.  Differences are:

1. Router address of VLAN4 is at 10.32.148.1.  The LAN that we created earlier is at 10.32.147.1.
2. On VLAN4,  I decided to hand out a maximum of 20 DHCP addresses on the guest network.  The main home network on the LAN interface will generate up to 50 IP addresses with DHCP.
3. Under the Firewall Settings tab for VLAN4, we put VLAN4 in its own firewall zone that we create and name VLAN4.  Under Firewall Settings, click on 'unspecified-or-create', enter 'vlan4', then press 'Save and Apply'.  After doing that, your VLAN4 Firewall Settings will look like this:

Your Network->Interfaces should now look like this:

Note I did manually set MAC addresses for the LAN and VLAN4 interfaces, otherwise the system uses the same MAC address for every interface.  Seemed weird to me...

Start Sending VLAN4 Traffic to Managed Switch

Go to Network->Switch.  Click on 'Add' and send the VLAN4 traffic out the router port that is connected to the Cisco Linksys Managed Switch.  In my case, Port 1 of the router is connected to the Cisco Linksys managed switch.  Be careful here: the port drawing seems backwards to me so I just disconnected the Ethernet cable to watch where traffic disappeared and used that as the correct port on the router.

Port 0 is the WAN port, Ports 1 through 4 are the LAN ports (the openwrt drawing doesn't match the router unless you look at it from the rear), and Port 5 is the CPU.

After pressing add, enter the VLAN ID '4', set Port 1 to transmit/receive 'tagged' traffic and be sure to also set the CPU to transmit/receive tagged traffic.

We now have tagged VLAN4 traffic going to the managed switch, but we can't ping anything yet because we need to set up the firewall rules for VLAN4.

 Configure VLAN4 Firewall Settings

Go to Network->Firewall.  You'll see that the firewall rule named vlan4 is currently set to 'Reject' and there is no traffic allowed from the LAN to VLAN4.  We will modify the firewall settings so they end up looking like this:

Under the Zones, click on the vlan4 edit button and make the following changes to allow vlan4 traffic out to the WAN (give vlan4 access to the Internet):

After saving the vlan4 zone firewall settings, go back to Network->Firewall, go down to the lan zone, then click on the lan Edit button.  Make the following changes to allow the lan to access devices on vlan4 (but not vice versa):

Run in Circles, Scream and Shout

Would you believe we're done?   Hooray!

You should now have a Guest Network that can connect to the Internet but is fully isolated from your main Home Network.

Articles in This Series:

• Guest Wifi Network - Part 1 - Device Selection
• Guest Wifi Network - Part 2 - Why VLANs
• Guest Wifi Network - Part 3 - Setting Up the TPLink TL-WA801N Access Points
• Guest Wifi Network - Part 4 - Setting Up the Cisco Linksys Sg300-10P Managed Switch
• Guest Wifi Network - Part 5 - Installing Openwrt on the TPLink TL-WR1043ND Router
• Guest Wifi Network - Part 6 - Setting Up the TPLink TL-WR1043ND Router

This article is one of a multi-part series on setting up a segregated Guest Network, including a guest WiFi network, within a Home Network.  It is essentially an introduction to Virtual Local Area Networks ( VLAN), provides a simple use case for VLANs and gives a complete set of recommended hardware plus details the setup of that hardware.

The series of Guest Network articles progresses as follows:

1. We select a set of low cost hardware to meet  our criteria of creating a Guest Network, including Guest WiFi, within our Home Network.
2. We go into some detail why we use VLANs and a managed switch.  Understanding VLANs is key to understanding how to build a guest network.
3. We set up the TPLink TL-WA801N WiFi Access points.  This is a very simple process where configure each AP onto our Home Network and configure the AP's WiFi to operate on our separate Guest Network VLAN.
4. We set up our managed switch, a Cisco Linksys SG300-10P, to send Home Network traffic to only the Home Network devices and Guest Network traffic to only the Guest Network devices.  And we show the special case of mapping the Guest Network Access Points onto both networks simultaneously.
5. We begin preparing our main router, a TPLink TL-WR1043ND, to create and manage the VLAN traffic for our Home Network and our Guest Network.  Since the WR1043ND does not come with 802.1q VLAN support out of the box, this article is where we install openwrt on the WR1043ND.
6. Lastly, we configure openwrt on the TPLink TL-WR1043ND to create and manage all the VLAN traffic.

In this article of the series, Part 5, we replace the stock TPLink firmware of the TL-WR1043ND router with a version of openwrt that is compiled specifically for this router.  We need to use openwrt because it fully supports the 802.1q VLANs we will be using to create and maintain our separate Home Network and Guest Network.

Install Openwrt on the Router

The TPLink TL-WR1043ND WiFi Gigabit router does NOT support 802.1q VLANs with the standard TPLink firmware.  We will replace the firmware with openwrt to get the 802.1q functionality.

Fortunately, there are firmware images readily available to easily add openwrt.  Warning: you can 'brick' the router if you screw this up, making your life difficult. Be careful.  No warranties.

Before powering up your WR1043ND, download the appropriate firmware image from the openwrt website using your existing Internet connection.  I googled 'wr1043nd openwrt' and it brought me directly to the appropriate webpage.  Download the Stable, Factory image for the version 1 hardware you purchased.  My WR1043ND says it is version 1.11 on the label on the back of the WR1043ND, so I downloaded the V1.X, Stable, Factory image.  Be very careful to download the proper image for your hardware version and existing software.

Following are the 2 stable versions of TPLink WR1043ND openwrt 'Barrier Breaker' firmware for the version 1.X WR1043ND hardware that we successfully used in February 2015:

• For version 1.X hardware if installing over TPLink Factory firmware image
• For version 1.X hardware if installing over existing openwrt image

If you have the version 2.X hardware, it uses an Atheros AR8327N switch chip instead of the Realtek RTL8366rb that is used in the V1.X hardware.  It appears from the documentation of openwrt ticket #12181 that the 'Barrier Breaker' V14.07 Stable image does NOT have the 802.1q VLAN support so you will need to use a Trunk image (or build your own from source) instead of downloading the Stable image.  So buying V1.X hardware might be easier 🙂

Download and save the appropriate firmware image (.bin) file, either from the selections above or get the needed image from the openwrt website.  Be sure to pay attention to the location of the folder that you downloaded into since you'll need to get back to the same folder in a few moments (when you no longer have an Internet connection).  You may need to rename the openwrt firmware image file to a shorter name: my router would not recognize the file until I shortened the name.

Now that you have downloaded the openwrt firmware to your laptop (quick check: do you remember which folder the file is in?), you will disconnect your laptop from your existing Internet-connected network and connect it to the new WR1043ND.

I recommend you power up your new WR1043ND, but do not plug it into any existing network.  Unplug your Ethernet cable from your laptop (after you have previously downloaded the openwrt firmware), connect your laptop to a LAN port on the new standalone WR1043ND, run a Windows CMD shell to perform the command 'ipconfig /release' and 'ipconfig /renew' and your laptop should now have an IP address in the 192.168.1.X range that was generated by the WR1043ND.

An out-of-the-box WR1043ND will be at IP address 192.168.1.1 on its LAN with a login user name of 'admin' and a password of 'admin'.  If you have modified any of these parameters, you'll need to respond appropriately.

Use your browser to login to 192.168.1.1, user: admin, password: admin.

From the stock TPLink firmware, choose the menu 'System Tools->Firmware Upgrade':

Browse to the openwrt firmware image you just downloaded, press the 'Upgrade' button in the above dialog box, and be patient.  Wait for the WR1043ND to upload the firmware, write it to its flash RAM, and reboot: this can take a few minutes.  Wait for it to complete. 

Login to Openwrt

Once the firmware upgrade is complete, you will see the front panel lamps on the WR1043ND light up with the SYS lamp on steady.  Re-enter the IP address 192.168.1.1 in your browser.

The default user name is 'root' and there is no password at first login.  Complete the login and create a new password, as prompted.

Setup WAN Interface in Openwrt

Go to Network->Interfaces.  Click on WAN.  Following is a shot of my WAN setup.  It required no changes since my WR1043ND plugs into a cable modem that has its own DHCP server.  So the WR1043ND is simply a DHCP client on its WAN port.

Please note there is considerable documentation on the openwrt WR1043ND web page about the  'WAN Port Disable' bug.  I DID NOT experience the 'WAN Port Disable Bug', however I thought I did!  My Comcast Docsis 3 cable modem is very picky about replacing the router connected to the cable modem: it will not allow a new device to be plugged in without repowering the cable modem.  So once I connected the WR1043ND to the cable modem and cycled the power on the cable modem, the WR1043ND WAN port picked up an IP address from the cable modem and began working fine.

Verify your WAN port is connected before continuing: you should see the uptime increment in the above screen.

Setup LAN Interface in Openwrt

Go to Network->Interfaces.  Click on LAN.  Following is a shot of my LAN setup.

Referring to the network diagram at the beginning of this article, we set up the LAN to  have the router at 10.32.147.1, the mask to 255.255.255.0 (maximum 254 addresses on LAN), and the DHCP to provide addresses from 10.32.147.100 through 10.32.147.149 for our main home network devices.

What's Next - Configuring VLANs on the Router

Now that we have openwrt installed on our router, we can proceed to the final step in our series of articles where we setup the router for our 802.1q VLAN traffic.

Next article: Setting Up the TPLink TL-WR1043ND Router.

Articles in This Series:

• Guest Wifi Network - Part 1 - Device Selection
• Guest Wifi Network - Part 2 - Why VLANs
• Guest Wifi Network - Part 3 - Setting Up the TPLink TL-WA801N Access Points
• Guest Wifi Network - Part 4 - Setting Up the Cisco Linksys Sg300-10P Managed Switch
• Guest Wifi Network - Part 5 - Installing Openwrt on the TPLink TL-WR1043ND Router
• Guest Wifi Network - Part 6 - Setting Up the TPLink TL-WR1043ND Router

This article is one of a multi-part series on setting up a segregated Guest Network, including a guest WiFi network, within a Home Network.  It is essentially an introduction to Virtual Local Area Networks ( VLAN), provides a simple use case for VLANs and gives a complete set of recommended hardware plus details the setup of that hardware.

The series of Guest Network articles progresses as follows:

1. We select a set of low cost hardware to meet  our criteria of creating a Guest Network, including Guest WiFi, within our Home Network.
2. We go into some detail why we use VLANs and a managed switch.  Understanding VLANs is key to understanding how to build a guest network.
3. We set up the TPLink TL-WA801N WiFi Access points.  This is a very simple process where configure each AP onto our Home Network and configure the AP's WiFi to operate on our separate Guest Network VLAN.
4. We set up our managed switch, a Cisco Linksys SG300-10P, to send Home Network traffic to only the Home Network devices and Guest Network traffic to only the Guest Network devices.  And we show the special case of mapping the Guest Network Access Points onto both networks simultaneously.
5. We begin preparing our main router, a TPLink TL-WR1043ND, to create and manage the VLAN traffic for our Home Network and our Guest Network.  Since the WR1043ND does not come with 802.1q VLAN support out of the box, this article is where we install openwrt on the WR1043ND.
6. Lastly, we configure openwrt on the TPLink TL-WR1043ND to create and manage all the VLAN traffic.

In this article of the series, Part 2, we discuss the principles and VLANs that we will be using to create our Guest Network.  We'll use simple network diagrams to illustrate concepts, clarify our approach, and offer alternatives.

Review - What is a LAN

Before we jump into a discussion about VLANs, let's review what a LAN  is: a number of Ethernet or WiFi devices all connected together that can talk to each other.  They share a 'broadcast domain' to allow the devices to know about each other and cooperate.  Here is a picture of a simple LAN: all the devices are in the same IP address range from 10.32.147.1 through 10.32.147.254.

Basics of a Single LAN

In the above example, we would define a LAN with the following characteristics:

• The router's IP address is 10.32.147.1.  It is the 'gateway' that all our devices go to whenever they need to get out to the Internet.
• The mask for this LAN is 255.255.255.0: there can be up to 254 devices on this LAN.
• The router's DHCP server hands out IP addresses to each device as it connects to the network. For example, we may have set up DHCP to hand out an address in the range from 10.32.147.100 through 10.32.147.150 whenever a new device is plugged into the LAN (or connected via WiFi).
• The router passes the DNS addresses to the devices on the network. The Domain Name Service is the system that associates a URL name (www.alduras.com) with an IP address.  All communications occur using IP addresses rather than names.

When a new device (PC, laptop, phone, etc.) connects to our LAN, it therefore gets the following information from the router:

• IP Address. The device's IP address, for example 10.32.147.100.  The router's DHCP server generates this local IP address.
• Mask. The device's mask.  In our example, this would always be 255.255.255.0, meaning  this LAN can support up to 254 devices.
• Gateway. The gateway address to be used by the device.  In our example, this is the router's address 10.32.147.1.  The device will therefore go to the gateway any time it needs information about devices outside our LAN addresses (for example, for all Internet access).
• DHCP. The address of the DHCP server used to request the device's IP address.  In a small network, this is virtually always the router's IP address, or 10.32.147.1 in our example.
• DNS. The address of DNS servers to query when trying to resolve a name to an IP address.

Approach #1 - Adding a Guest Network Using Two Physical LANs

In the above single LAN example, all our devices are in the same network: all the devices communicate with each other by virtue of being within the address range of 10.32.147.1 through 10.32.147.255.  The highest address, 10.32.147.255 is the multicast address: the address that any device can use to broadcast a message to all devices within our LAN.  Multicast never goes outside a LAN: it stays within the local network only.

This single LAN is fine if we trust every device equally and we don't have any need to throttle service to any particular device.  This approach is quite sufficient for most home networks.

But what happens if we have guests in our home?  Do we want them to have access to the files and computers on our LAN?  Or do we want our guests to have their own private LAN to ensure security of our files and computers, but still give our guests access to the Internet?

Before VLANs, the simplest method to create a second LAN would be to buy a second switch, buy a second WiFi access point, and run some wires to handle just LAN #2.  We would add all the devices and wires to create a new LAN (the 10.32.148.X LAN) as shown in the following diagram.  Note that each LAN has a unique IP range: this a requirement of separate LANs so the router knows which LAN is to be used (how to route the packets).

Approach #2 - Adding a Guest Network Using One Physical LAN With Two Virtual LANs - Unmanaged Switch

However, adding a second physical LAN is expensive and inefficient.  Why buy the second unmanaged switch and run new wires (all that equipment on the right in the above diagram)? How about we just use all our existing wiring?

The concepts are still the same with our VLAN instead of our physical LAN.  Each VLAN is its own world with its own unique set of IP addresses, otherwise the router does not know where to route packets.

In this approach (and all subsequent approaches), we still have only one Ethernet wire - one physical LAN - but now we essentially split that wire into two virtual wires, or Virtual LANs:

• VLAN1 - 10.32.147.x for our personal traffic
• VLAN2 - 10.32.148.x for our guest traffic

If we have a VLAN aware router, we simply ask it to put the VLAN1 traffic AND the VLAN2 traffic out on the same port of the router.  There are two ways we can do this:

1. We can output the VLAN1 traffic 'untagged' and the VLAN2 traffic 'tagged'.  The advantage here is all the receiving devices of VLAN1 traffic do NOT have to be be VLAN aware: they will simply ignore the VLAN2 traffic.
2. We can output BOTH the VLAN1 and LAN2 traffic as 'tagged' VLANs.  Pandomonium ensues.  Nothing talks because now every device has to be VLAN aware: every device has to be able to dissect the special VLAN traffic and pull it out of the packets.  The packets are reaching the devices in this scenario, but the devices don't know what to do with the VLAN packets.

In the above diagram, each Ethernet cable is carrying both the VLAN1 traffic (the black VLAN1 untagged '1U' traffic) and the VLAN2 guest traffic (the red VLAN2 '2T' tagged traffic).  When you see a red 'wire' alongside a black 'wire' above, it is NOT two different wires, but is instead a depiction of a VLAN connection with two (or more) sets of VLAN traffic traveling down the same Ethernet wire.

When we configure the router to send multiple VLAN traffic over an Ethernet connection and use an unmanaged switch, the VLAN1 and VLAN2 traffic is reaching every device, as shown above.

There are some problems with using the unmanaged switch in the above diagram:

1. The Guest Laptop will automatically connect to the Main Home Network, not the Guest Network.  The VLAN1 (Main Home Network) traffic is the untagged traffic so the Ethernet of the laptop will use that traffic by default.  Many laptops do have a provision to connect to a tagged VLAN by editing the network device hardware settings, but requiring your guests to modify their laptop settings just so they are not using your main home network is impractical.
2. The VLAN2 (Guest Network) traffic is needlessly being transmitted to all devices, not just the devices that need to access the Guest Network.

Tagged vs. Untagged VLANs

In our diagram above, we introduced the concept of tagged and untagged VLANs.

• An 'untagged' packet is just a standard Ethernet packet: every device on the network will look at the packet and determine whether they should receive the packet.  In our diagrams here, notice we always have a 'U' (untagged) wire going to every device: that is the untagged VLAN that every device knows how to handle.
• A 'tagged' packet is essentially a hidden packet: every device on the network will ignore the tagged packet unless they are specifically looking for that exact VLAN tag number in the tagged packet.  For a device to handle 'tagged' packets,  that device must be explicitly configured to look for tagged packets .  For example, if you want your PC to react to a tagged VLAN, you will need to set up the PC's Ethernet 'card' to look at only the traffic for a particular tagged VLAN number.  In our diagrams here, notice we sometimes have a 'T' (tagged) virtual wire running alongside our physical 'U' (untagged) wire: we 'cheated' and created a second virtual Ethernet wire using our tagged VLAN.

In a nutshell: 'untagged' traffic just works without any special setup, but tagged traffic is that second (or more) Ethernet Virtual LAN that is ignored unless the receiving device is specifically looking for those tagged Ethernet frames.

You can only have one untagged VLAN on a port, however you can have many tagged VLANS on a port.  If you try to put multiple untagged LANs on a port, it does not work.

Approach #3 - Adding a Guest Network using VLANs - Unmanaged Switch, Improved

With a bit of rewiring, we can utilize the unmanaged switch and the extra ports on the router to fix our problems with our prior approach.  This change will work if we can physically move wires.

With a couple wiring changes (connecting the AP and guest laptop directly to ports on the 802.1q VLAN capable router), we have dramatically improved our network.

1. All the devices on our main home network are receiving/transmitting only the VLAN1 10.32.147.X traffic.  In VLAN parlance, we have placed VLAN1 untagged traffic (1U in above diagram) on the left port of the router.
2. The guest laptop is receiving/transmitting only the Guest Network 10.32.148.X traffic.  In VLAN parlance, we have placed VLAN2 untagged traffic (2U in above diagram)  on the port of the router that is second from the right.
3. The guest Access Point is managed from a home network IP address, but the WiFi is on the Guest Network.  In VLAN parlance, we have placed both VLAN1 untagged traffic and VLAN2 tagged traffic (1U + 2T in above diagram) on the right port of the router.

We have accomplished our goal to separate the Home Network and Guest Network by using an 802.1q compliant router and performing a bit of knowledgeable rewiring.

Approach #4 - Adding a Guest Network using VLANs - Managed Switch

Although we accomplished our goal to separate out our Guest Network in the above scenario, we can make some notable improvements by replacing our unmanaged switch with an 802.1q compliant managed switch that has the ability to simultaneously map untagged and tagged traffic to any port (such as the Cisco Linksys SG300P).

Some of the advantages of upgrading to a managed switch:

1. Complete flexibility of which VLAN traffic goes out on which port.  We can map any VLAN tagged and/or untagged to any port.  This ensures security and reduces unnecessary traffic: each device receives only the VLAN traffic appropriate for the device.
2. We don't need to rewire anything like we did in the above scenario.  The switch can receive all VLAN traffic from the router, then the managed switch can flexibly route traffic uniquely to each switch port as needed.
3. We can place our Ethernet wiring in one physical location and not have to worry how our network may need to be rewired based on our changing needs.  For example, when rewiring my house (or business), I simply ran every Ethernet wire to one closet and put a large managed switch in that closet.
4. With the low cost of managed switches today, there is no compelling financial reason to buy an unmanaged switch.  Managed gigabit switches are readily available for under $100.

So lets make a change and replace the Ethernet switch with a managed Ethernet switch.  Now our VLAN based network can be cleaned up by configuring the managed switch to only pass traffic through the switch ports that make sense for our devices.

In the above diagram, red is VLAN2 traffic across our Ethernet wires, black is VLAN1 traffic, the 'U' means 'untagged' VLAN traffic and the 'T' means tagged VLAN traffic.

Our managed switch basically lets us 'carve up' the switch into a bunch of separate switches.  We can overlap untagged and tagged traffic on each port of the switch in any manner we please.

Lets take a look at how we configured our managed switch above:

• Ports 1-6 (the left ports) are configured to pass the LAN1 traffic untagged to all the devices connected to the 10.32.147.x network.  The VLAN2 traffic does not appear on any of those devices.
• Port 7 (second from right) is configured to take the tagged VLAN2 traffic from the router, strip off the tags, and send VLAN2 traffic untagged out port 7.  So this makes it real easy to configure the laptop connected to port 7: it is just a normal Ethernet configuration that does not have to be VLAN aware.  The laptop is on our guest 10.32.148.x network and cannot access any files or computers on the 10.32.147.x network (assuming the router's firewall is configured to prevent bridging).  So now we can safely host a guest laptop without worrying about that laptop affecting our personal home machines.  And the guest just plugs in to the Ethernet, lets DHCP hand out an address in a normal fashion, and enjoys high speed Internet access.
• Port 8 (rightmost) is configured to pass the VLAN1 traffic untagged and the VLAN2 traffic tagged to the guest access point. That lets us put the configuration web page of the AP at one of our 10.32.147.x VLAN1 addresses, but puts the WiFi on our 10.32.148.x VLAN2 guest network.  So we can manage the AP from our home computers, but the guests only get into the guest WiFi network.  This requires an AP that supports SSID to VLAN mapping, such as the TPLINK TL-WA801ND Access Point.
• The uplink port of the managed switch (shown at the rear of the switch in the diagram above) receives VLAN1 traffic untagged and VLAN2 traffic tagged.  All traffic is passing over this trunk port between the switch and the router.

802.1Q - Router Required Feature for VLANs

When purchasing a router, you'll need one that supports 802.1Q VLANs in order to set up your segregated guest network.  This is a function of the model of switch chip on your router: not all switch chips support the simultaneous tagged and untagged VLANs as we have shown in the above drawings (when there are red and black side-by-side virtual wires in the above diagrams).

If you decide to install a managed switch (approach #4 above), it will also need to support 802.1Q VLANs.  I highly recommend a managed switch since it makes it so easy to 'carve up' your network into exactly what you may need, regardless of location or wiring.  If all you're doing is setting up some WiFi access points on their own guest network (not setting up any wired Ethernet separate networks), then the managed switch is of less importance.

When you look at the switch chip features of your router and managed switch, you will see the following terminology related to VLAN port configuration:

• Access Ports.  These are ports that input and output ONLY untagged VLANs.  They will NOT work for our guest network since they essentially do not support VLANs.
• Trunk Ports.  These are ports that can output one untagged VLAN (the 'native' VLAN which us usually VLAN1) and any number of tagged VLANs.  For our guest network using VLANs, it is sufficient to use Trunk Ports.
• General Ports (Hybrid Ports).  These are ports that can map any tagged or untagged port to any other tagged or untagged port.  In complex configurations, this flexible mapping can be used to speed up VLAN to VLAN switching by doing the switching at 'wire speeds', however there is no need for this capability in any of our guest network setups.  Our guest network setups are careful to configure firewall rules between networks, so the router CPU must get involved, and therefore these 'wire speed' capabilities are of little use in our routers.

Some brands/versions of router Software will refer  to Trunk Ports and mean ports that can output ONLY tagged VLANs: they don't support the one untagged native VLAN simultaneously on that Trunk port.  Openwrt Version 18 seems to do a very good job of supporting simultaneous tagged/untagged VLANs on an 802.11Q Trunk port on many router models (if the switch chip supports it), but you will want to verify that capability before beating your head against the wall trying to get VLANs to work on your router.

If you refer to any of the Learning Articles here on this website (alduras.com) for routers I have set up with openwrt, they each support 802.1Q trunking.

When purchasing your router, it seems to be much too difficult to determine if they are truly 802.1Q capable.  It seems to take a lot of careful and time-consuming  searching.  Do be diligent to search for that 802.1Q feature when you purchase your guest network router.

What's Next - Configuring the AP, Router & Switch

So now we have a nice, secure guest network together with a separate private home network.  We'll configure the rules in the router firewall to keep VLAN1 and VLAN2 separate (however, maybe we'll allow VLAN1 to access VLAN2, but not vice versa).

Now that we understand the basic concepts of how we want to use VLANs and the managed switch to create our separate networks, let's go on to the next part in our series where we configure our Access Points.

Next article: Configuring the Access Points.

Articles in This Series:

• Guest Wifi Network - Part 1 - Device Selection
• Guest Wifi Network - Part 2 - Why VLANs
• Guest Wifi Network - Part 3 - Setting Up the TPLink TL-WA801N Access Points
• Guest Wifi Network - Part 4 - Setting Up the Cisco Linksys Sg300-10P Managed Switch
• Guest Wifi Network - Part 5 - Installing Openwrt on the TPLink TL-WR1043ND Router
• Guest Wifi Network - Part 6 - Setting Up the TPLink TL-WR1043ND Router

We run a small Bed and Breakfast out of our house - or actually a couple vacation rental Suites since we don't offer the breakfast part of the B & B.  I'm no cook :-),  just a techno-geek who has thoroughly enjoyed meeting the friendly guests that have stayed in our home.

When we show our guests around, 100% of them have asked 'What is the WiFi password?'  Every group of guests, of every age, has asked this question.  No kidding: 100%.  As an aside, our vacation rentals don't have phones: we rely on guest cell phones.  So far, not one comment or question about the lack of phones.  Its fair to say the world is now mobile - at all ages.

So figuring out a way to set up a guest WiFi network is de-rigueur for a vacation rental host in today's world.

My first attempt at setting up a guest WiFi network was easy and inexpensive.  I ran Cat5E wires to each level of the house, put an Access Point at each level, and installed a switch to feed wired Ethernet to each Access point. I plugged those into my router and had a functional house-wide Wifi network in no time.

About This Series of Articles

This article is one of a multi-part series on setting up a segregated Guest Network, including a guest WiFi network, within a Home Network.  It is essentially an introduction to Virtual Local Area Networks ( VLAN), provides a simple use case for VLANs and gives a complete set of recommended hardware plus details the setup of that hardware.

The series of Guest Network articles progresses as follows:

1. We select a set of low cost hardware to meet  our criteria of creating a Guest Network, including Guest WiFi, within our Home Network.
2. We go into some detail why we use VLANs and a managed switch.  Understanding VLANs is key to understanding how to build a guest network.
3. We set up the TPLink TL-WA801N WiFi Access points.  This is a very simple process where configure each AP onto our Home Network and configure the AP's WiFi to operate on our separate Guest Network VLAN.
4. We set up our managed switch, a Cisco Linksys SG300-10P, to send Home Network traffic to only the Home Network devices and Guest Network traffic to only the Guest Network devices.  And we show the special case of mapping the Guest Network Access Points onto both networks simultaneously.
5. We begin preparing our main router, a TPLink TL-WR1043ND, to create and manage the VLAN traffic for our Home Network and our Guest Network.  Since the WR1043ND does not come with 802.1q VLAN support out of the box, this article is where we install openwrt on the WR1043ND.
6. Lastly, we configure openwrt on the TPLink TL-WR1043ND to create and manage all the VLAN traffic.

In this article of the series, Part 1, we identify the hardware we purchase to allow us to create a Guest Network with WiFi.

Problems With Having Access Points on My Home LAN

1) Security.  I was not keen on having guests on my internal network that feeds my PCs, laptops, phones, tablets, BluRay, ...  I wanted to ensure the guests cannot bring in a virus to affect my network computers or access information from my computers - so I wanted them on their own network.

Honestly, it gave me the creeps to know my taxes and personal financial information were on a network PC that was accessible by my well-intentioned guests!  Who knows what kind of nasty, unknown, undetected virus they were bringing onto my network with the devices they brought from their homes.

2) Power for the remote Access Points.  When we remodeled, we ran Cat5E throughout the house, but the ideal location for each Access Point does not always have a 110VAC power plug near the Ethernet jack.

Technologies To Put Guests on a Private WiFi Network

1) VLAN.  VLans will ensure complete segregation of the guest network.  The buzzword here is 802.1q.  We will use a router and switch that fully supports 802.1q to create the separate guest network without running any new Ethernet wiring.

2) Power Over Ethernet.  A PoE managed Ethernet switch will allow each Access Point to be powered directly from the switch: no 110VAC needed near the Access Point.  The buzzword here is 802.3af (original low power PoE) or 802.3at (newer high power PoE).  Our switch will need to support 802.3af so we can power each Access Point remotely from the Ethernet switch.

Devices Purchased

The following devices were low cost, yet had excellent reviews at the time of this installation (February 2015).  The devices were selected to ensure they support the technologies needed: 802.1q VLANs and 802.3af PoE.  I spent just under $500 total with PoE.  Without PoE, the total cost is around $200: quite a bargain to get whole-house WiFi with a secure, separate guest network..

1) TPLink TL-WA801ND Access Points.  Quantity two.  About $52 each.  I installed one for WiFi coverage of the upper house level and the second Access Point for WiFi coverage of the ground house level.  The main level of the house receives WiFi coverage via a third device: a TPLink TL-1043ND WiFi router (my Internet-connected main router).  Now I have WiFi radios on each of the three levels of the house to assure excellent WiFi coverage everywhere.  The stock TPLink firmware of the WA801ND supports 802.1q WiFi VLANs using a feature called Multi-SSID.

Update: I tried using these TL-WA801ND Access Points for about a year and made a point of upgrading the firmware whenever TpLink released new versions.  But these were NOT reliable: each of them would crash and lock up every few days to few weeks.  This was totally unacceptable for our Bed & Breakfast since these access points seemed to sense when I was out of town, not available to bring them back to life.  I needed RELIABLE hardware and these did not fit the bill. 

I have since replaced these TL-WA801ND AP's with multiple ZyXel NWA-1123 AP's and there is a night and day difference in reliability.  Not one crash in over two years time with the ZyXel Access Points.  The ZyXel AP's also easily support the VLAN configurations and (true) PoE described throughout these documents.   The Zyxel AP's include both 2.4GHz and 5 GHz radios: they support 802.11 a/b/g/n/ac instead of just 2.4GHz  b/g/n.  Definitely more expensive than the TpLink AP's, around $100 each instead of $55 each ($35 for TpLink AP plus $20 for TpLink PoE Splitter), but I need equipment that works!

2) TPLink TL-POE10R PoE Splitters.  About $20 each.  Quantity two.  This device regulates the 802.3af PoE (48VDC) Ethernet from my PoE Switch to the required 9VDC of the TL-WA801ND Access Points and provides the power connector cable to operate the TL-WA801ND directly from my Ethernet wiring.  Each Access Point therefore requires no nearby AC power plug.

Update: Not needed with the ZyXel NWA-1123 Access Points since the ZyXel AP's support PoE directly without this somewhat kludgy adapter.

3) TPLink TL-WR1043ND Wifi Router.  About $50.  This is a dual band (2.4GHz/5GHz) Wireless N Router with four gigabit Ethernet LAN ports and a gigabit WAN port.  By replacing the stock firmware with openwrt, this router fully supports 802.1q VLANs.  A full 802.1q implementation is required to make the VLANs work properly for my configuration: we'll make use of this router's ability to put untagged frames and tagged frames on the same port simultaneously.

Please note: if you purchase the V2.X TPLink TL-WR1043ND, it uses a different switch chip which does NOT yet (as of Feb 2015) have a 'Stable' build of openwrt available with 802.1q support. These series of articles assume you have purchased V1.X hardware, as depicted above.  If you instead purchase V2.X hardware, you may need to build openwrt from source which is a task not covered in these articles.

4) LinkSys SG300-10P Gigabit managed PoE Switch. About $280: ouch.  A newer option for a gigabit managed PoE switch is the Linksys LGS308P: 8 ports gigabit PoE (instead of 10), but also supports the higher power 802.3at PoE and is available for about $140.  The SG300-10P managed switch fully supports 802.1q VLANs.  This switch is fanless: no need to listen to liftoff of the space shuttle here! Why spend so much money on the switch?  You can spend less: see the following list of features we'll need.

Switch Features For a VLAN Segregated Network

• A managed 802.1q VLAN capable switch.  Each port is individually configurable to be in a tagged and/or untagged VLAN.  This means the switch must be 'managed' or 'smart': an unmanaged switch does not have the ability to map VLANs to ports.  When purchasing your switch, make sure it supports simultaneous tagged and untagged VLANs on the same port: this will simplify your setup and maintenance, IMHO.
• Gigabit ports.  I wanted to be able to transfer files between computers at maximum speeds so I opted for a switch with 10/100/1000 ports.  Prices of gigabit managed switches are now so low that it is simply not worth considering buying a 10/100 managed switch.
• PoE.  I don't have 110VAC power near my Access Points.  So the switch needs to provide the power to run my Access Points, Cameras, and VoIP telephones.  There are two relevant PoE standards: the original lower power 802.3af (suitable for most PoE devices) and the newer higher power 802.3at (needed for some PTZ cameras and such).  You could skip purchasing a PoE switch and save a lot of money: gigabit managed switches (no PoE) are available for around $50.  So I'm basically forking over about an extra $90 (for a LinkSys LG308P) to purchase PoE because I don't always have 110VAC near my Access Points, Cameras, or VoIP telephones.
• Fanless.  A noisy switch is no fun if its in your office.  PoE can require lots of power - meaning lots of heat - so if you need more ports (and therefore a switch with a fan), it might be better to put your switch in a remote location where you don't have to listen to the beast.

Update: after having PoE for a few years, it has been a very worthwhile addition since we now have 3 PoE Access Points to ensure excellent coverage inside and outside our Bed & Breakfast, two PoE VoIP telephones, and a PoE PTZ camera.  The VoIP phones save us a LOT of money on our phone bills (less than $5/month total for our two desk phones using voip.ms), so the PoE has been incredibly convenient and cost effective.

What's Next - Creating Our VLANs

In the next part of our series, we'll discuss LANs and VLANs.  We'll draw a simple network diagram to show how we'll use a VLAN to separate out our guest traffic.  And we'll go over the reasons why a managed switch is so useful, and frequently necessary, when using VLANs.

Next Article:  Why VLANs

Articles in This Series:

• Guest Wifi Network - Part 1 - Device Selection
• Guest Wifi Network - Part 2 - Why VLANs
• Guest Wifi Network - Part 3 - Setting Up the TPLink TL-WA801N Access Points
• Guest Wifi Network - Part 4 - Setting Up the Cisco Linksys Sg300-10P Managed Switch
• Guest Wifi Network - Part 5 - Installing Openwrt on the TPLink TL-WR1043ND Router
• Guest Wifi Network - Part 6 - Setting Up the TPLink TL-WR1043ND Router

Mikrotik RB450G openwrt Installation

The Mikrotik RB450G is a high quality 10/100/1000 5 port router available in a steel case.  Its a powerhouse small router with a 680 MHz MIPS processor, 256MB RAM and 512MB NAND flash. It has a serial port, SD card slot, will run from a 24V DC supply and is rated for -40 to +70 degrees C.  They are designed to be used in some pretty challenging outdoor environments so they have to be robust. I've been using the RB450G for industrial applications and found them to be reliable.  They ship with a proprietary Mikrotik OS that has a surprisingly full feature set for router applications. These routers give Cisco a run for their money at a fraction of the cost. The irony of the full feature set is that this router is difficult to learn for industrial applications: we simply don't need most of the features and their immense routing flexibility is not used for an industrial application.

Since The Mikrotik OS is proprietary and does not lend itself to modification or augmentation, I'd like to get an open source version of Linux running on this hardware to customize the RB450G for industrial applications. Following is the process I've used to get the open source Linux openwrt distribution running on the RB450G.

I'm following the openwrt build instructions found here:
wiki.openwrt.org/toh/mikrotik/rb450g

Update: I originally wrote this posting in 2014 when openwrt was at version 'Attitude Adjustment'.  When you read this posting, you will see there were a LOT of steps to get openwrt installed on the RB450G back in 2014.  As of November 2018, openwrt is at version 18.06.1 - and it is now remarkably simpler to install openwrt on the Mikrotik RouterBoards.  I wrote an in-depth posting about installing V18 openwrt on the RB493G and that article is entirely applicable to the RB450G too.  So continue reading this article if you would like to know how to install Attitude Adjustment openwrt on your RB450G, but if you would prefer to use a much newer, substantially simplified (V18) openwrt installation process, see this posting:
Installing Openwrt on the Mikrotik RB493G

My instructions here are Windows 7 oriented. The openwrt RB450G installation instructions you'll find elsewhere on the Internet tend to use Linux for most operations.  I've been using Unix and Linux for 25+ years but my daily machine is my Windows 7 laptop.  Virtually every form of Industrial software runs from Windows so that's my first line of defense for my paying jobs.  My apologies to the Linux fans: I love Linux, but I'm really familiar with Windows 7 by virtue of professional necessity.

My main computer is a Windows 7 64 bit laptop with its maximum 8GB RAM and a 500GB flash drive.  To build openwrt, I need a Linux desktop machine.  The build instructions recommend Debian.

Step 1 - Install a Virtual Machine on my Windows Laptop
There are numerous virtual machines out there: VMWare, Windows Virtual PC, and VirtualBox are the three most common free versions that come to mind.  The VMWare player license stipulates that it cannot be used for profit, the Windows Virtual PC is just for XP virtual machines, so that left me with VirtualBox.

The VirtualBox install was painless but time consuming. Its an Internet download. I went to www.virtualbox.org and downloaded the Windows amd64 version of VirtualBox.

One quick note about the version of software to get whenever downloading for the Intel processor that my laptop uses:
The correct image to get for my Intel processor is 'amd64': don't make the mistake of grabbing the 'ia64' version because that is for the incredibly rare and unique Itanium Intel processor.  If you have any modern Intel or AMD processor, the 'amd64' distribution is almost guaranteed to be the version you want.

Step 2 - Install a Debian Virtual Machine in VirtualBox
Download the latest netinstall version of amd64 Bit Debian from www.debian.org/CD/netinst.

I used the netinstall version because its a small initial file size and I have a fast Internet connection to later allow the Debian installer (apt-get) to just upload all the packages directly during the first boot of Debian.

In VirtualBox, click on 'new' to create a new VM.  I named it Debian64:

You may also notice from that screen capture above that I created a second virtual machine with the free 'parted' program in it.  I needed that to keep making the virtual disk larger because I started off with the default 8 GB disk: if you just initially size to a 25 GB disk, you should be able to skip re-partitioning your drive when you run out of space during the openwrt build: less hassle, more time to pet the dog. Woof

The values I changed from the defaults:

• Increased the memory to 1024M (Faster?)
• Increased the disk size to 25 GB (The openwrt build is huge)
• Set the network up for a 'Bridged Adapter' to my laptop's wired Ethernet adapter (We'll need the VM on our same network as the laptop later when we install to the RB450G).
• Go into the System->General->Advanced Settings and turn on Bi-Directional Shared Clipboard and Drag'nDrop
• Go into the Shared Folders configuration of VirtualBox to share the tftp folder between Debian and Windows. Create an auto-mounted shared folder at C:\TFTP-root with full R/W access

Step 3 - Install the VirtualBox Guest Additions Into Debian
Up to this point, we've been working within our Windows environment. Now its finally time to start work inside Linux.  Fire up your Debian64 virtual machine and lets start having fun with Linux!

The VirtualBox Guest Additions is a software package to install in Debian that will enable smooth mouse support, video integration and the features that permit cut, paste and file sharing between Windows and Debian. Unfortunately, VirtualBox does not directly support Debian so we will have to build the Guest Additions from source. Welcome to the world of Linux 🙁
The following instructions can be found at virtualboxes.org/doc/installing-guest-additions-on-debian. Open a terminal Window in Debian (Applications->Accessories->Terminal) and enter the following commands:
su
apt-get update
apt-get upgrade
apt-get install build-essential module-assistant
m-a prepare
Click on Install Guest Additions… from the Devices menu, then run
mount /media/cdrom
sh /media/cdrom/VBoxLinuxAdditions.run follow the instructions on screen.
exit

We have a couple more housekeeping tasks to make our Linux life easier: we need to edit the /etc/group file and add ourselves to the sudo group and the vboxsf group. This will allow us to use the sudo commands (below) and automount the /media/sf_TFTP-root folder for our shared tftp files.
cd /etc
su
vi group vi editing fundamentals instructions below
exit
Once you get in the 'vi' editor above, search for the 'sudo' group line by typing /sudo, then arrow to the end of the line and append by typing a, add your user name, then press the Esc key. Search for the 'vboxsf' group by typing /vboxsf, then arrow to the end of the line and append by typing a, add your user name, then press the Esc key. Now type :wq to write the group file and quit.

Do not forget that shell exit command after you have quit out of vi. You shouldn't be a superuser in Linux any longer than necessary.

Reboot your Debian VM now to force all the changes to get updated. After reboot, you should see the /media/sf_TFTP-root contents, proving the automount is working.

Step 4 - Get the Source Code for the Attitude Adjustment version of openwrt
We'll need to run the Debian package manager to ensure we can get the correct versions of openwrt from the Web. I have not had much luck with the Debian graphical package manager so I just open up a terminal window and run apt-get. You'll want to install svn and git:
su We need to be 'root' while installing packages
apt-get update Ensures you have the latest list of software versions
apt-get install subversion build-essential Installs the subversion source code control software
apt-get install git-core Install the git source code control software
apt-get install libncurses5-dev zlib1g-dev gawk Need these on Debian Wheezy for make to succeed
apt-get install openssh-server So we can copy files from RB450G to Debian using scp
exit Done with administrator stuff...

Now upload the Attitude Adjustment (12.09) version of openwrt:
cd ~Go Home
mkdir AttitudeAdjustment Our directory to install openwrt
mkdir AttitudeAdjustment/packages Our directory to install openwrt packages
git clone git://git.openwrt.org/12.09/openwrt.git AttitudeAdjustment Get all the openwrt source
git clone git://git.openwrt.org/12.09/packages.git AttitudeAdjustment/packages Wiki says get em. Don't know why yet...

Step 5 - Compile openwrt - Both Flavors
Verify you have all your packages needed to compile:
cd ~/AttitideAdjustment
make defconfig
make prereq
make menuconfig
Once you've verified all that works, upload an existing configuration file for the RB450G. That will save you the trouble of learning all the options to configure in the 'make menuconfig' that you ran above. Put this file at the top of your build directory (in ~/AttitudeAdjustment) and re-run 'make menuconfig'. Scroll down to 'Load an Alternate Configuration File' and load the file.

Then scroll to 'Target Images' and select 'ramdisk'.
This is some of the magic. There is a good reason this setting was not in the configuration file we loaded above: we're building this image to use just once. This ramdisk image is going to just run from the RAM on the RB450G long enough for us to get the permanent image loaded into the flash (called NAND) on the RB450G.

And now its time to compile our initial image:
make
This will take quite some time.
When its finished you'll have a throw-away version of Linux that you'll use (just once) to initially boot openwrt on the RB450G over the network. We'll use the utilities in this Linux to copy a second version of openwrt into the flash (NAND) on the RB450G.
Take a look in your bin/ar71xx directory: you should find a file named
openwrt-ar71xx-nand-vmlinux-initramfs.elf This is our network-bootable openwrt image.

Now its time to compile the 'permanent' version of openwrt that we will load into the NAND flash of the RB450G. We're going to remove that 'Target Images->ramdisk' from 'make menuconfig' that we ran above, then recompile. So run make menuconfig and reload the config.ar71xx_nand file using the 'Load an Alternate Configuration File' command in menuconfig. Now that we have the standard build configuration reloaded, compile our images again (don't worry about the initramfs image - it won't be overwritten by this new compile):
make
This will be much faster than the original build since most everything has already been compiled.  Take a look in your bin/ar71xx directory: you should find two files we'll be subsequently downloading into the RB450G:
openwrt-ar71xx-nand-vmlinux.elf This is our permanent 'kernel' openwrt image.
openwrt-ar71xx-nand-rootfs.tar.gz This is our permanent 'rootfs' openwrt image.

Step 6 - Backup the RB450G License Before You Overwrite Anything
Save your RB450G license and the current version of the software in case you want to get back to your original setup.  We'll use the Mikrotik winbox app to save the license.  So now we'll need an Ethernet cable plugged into any one of the last four ports on the RB450G: these are the default LAN ports on the RB450G.

I unplugged any other Ethernet cables from my laptop, turned off the Wifi, and plugged an Ethernet cable into Port 3 of the RB450G. Fire up a command window in Windows 7, then ask Windows 7 to give your PC (my laptop) a new IP address from the RB450G DHCP server by typing the following commands in my Windows 7 CMD window:
ipconfig /release
ipconfig /renew
ipconfig
You should now see your Ethernet of your PC in the 192.168.88.x range: these are the default LAN addresses of an RB450G. In your browser, type in the gateway address to access the RB450G web page: '192.168.88.1'. Click on Winbox, install it on your PC, login with admin and an empty password. Go to System->License. Press 'Export Key' and save the license to your PC (my laptop).

If you do need to re-install RouterOS again, it is a fairly easy process to use Mikrotik's netinstall utility.  Please refer to our post: Using Mikrotik netinstall to install RouterOS.

We're done running from the LAN port on the RB450G: disconnect the Ethernet cable from Port3 and reconnect your PC (my laptop) back up to the network. Re-run the ipconfig commands to get new IP addresses for your PC that are on your internal network (rather than the RB450G's LAN).

Step 7 - Decide How You're Going to Provide DHCP and a TFTP Server
To download the code to the RB450G we're going to need a DHCP server with PXE boot or BOOTP capabilities. We will also need a tftp server. In my case, I have Tomato running on a Buffalo WHR-G125 as my main connection to the Internet. I like Tomato: its simple, has a nice GUI, lets me track our internet usage. I use this Tomato router as my DHCP server. Tomato has provisions to handle PXE boot with DHCP so I'll use it here. If you don't use Tomato, I believe you can get the DHCP server and PXE boot running from your Windows 7 machine by using tftpd32. I've chosen not to use tftpd32 in order to avoid having two DHCP servers fighting with each other(Tomato and tftpd32).

To enable the PXE boot in Tomato, login to the Tomato admin webpage and go to Advanced->DHCP/DNS. Enter this command into the Dnsmasq Custom Configuration box:
dhcp-boot=vmlinux,,10.32.147.10

The file named vmlinux is the ram image that we are going to download into the RB450G: it will be on the Windows 7 machine at C:\TFTP-root\vmlinux. The IP address 10.32.147.10 is the address of my laptop: I have set that up as a static IP in Tomato so my laptop IP won't change (since I'm running a tftp server from it).

For convenience, I'll run a tftp server on my WIN7 laptop to serve up the files over tftp. I'll build the ELF image in Debian and copy it over to the Windows 7 tftp directory I've setup in the Solarwinds TFTP server.

The number of computers, VMs, and processes used here is getting a little crazy:

1. My Win 7 64 bit laptop is the root of my world. I have Tomato configured to always assign this laptop the same static IP address so as to simplify setup for the communicating devices.
2. Debian 64 bit running as a VM under VirtualBox.
3. Gparted 32 bit running as a VM under VirtualBox, pointing to the same .vdi disk as the Debian 64 VM. For when I need more disk space in the Debian64 VM.
4. A Buffalo WHR-G125 router running Tomato is my main router to the Internet. It is my DHCP server for my network, including the RB450G's WAN port connection.
5. Solarwinds free TFTP server running on Windows 7 to serve up the compiled RB450G images over Ethernet to the RB450G. This is configured to serve files from the folder C:\TFTP-root
6. A Tripp Lite Keyspan USA-19HS USB-to-serial adapter (with Windows 7 drivers) to connect RS-232 between my Win7 laptop and the RB450G serial console port.
7. Putty telnet client running on Windows 7 to access the RB450G console through the serial port.
8. The RB450G connected via its Eth1/PoE (WAN) Ethernet port (to my network) and the serial port (to my Keyspan USA-19HS).

I'm using the serial port from Windows 7. So I use the free program 'putty' as my telnet serial terminal emulator. Prior versions of Windows included hyperterm to do the equivalent thing, but the hyperterm telnet client is no longer in Windows 7. Putty is available here.

When I plugged the USB of the Keyspan USA19HS USB/serial adapter into my Windows system, I noticed it installed the serial port at COM3. If you didn't notice the com port during installation, take a peek in Control Panel->System->Device Manager->Ports(Com & Lpt) to determine which com port to use from Windows. Then I fired up putty and set it up for COM3 115200,N,8,1. When I press return, I get the RB450G console port prompt for login (yay). If it does not work, you may need a null modem adapter to get the RS-232 RCV/XMIT signals on the correct pins (2 & 3).  The default login is admin with no password. So now I have the serial port talking to the RB450G.

Step 8 - Copy the Compiled RAM Image, Kernel, and File System to Installation Folders
Go to the Debian command window and navigate to the ~/AttitudeAdjustment/bin/ar71xx directory. Copy the ram image file to the Windows C:\TFTP-root folder and the two permanent image files to the Debian /tmp directory. We rename the ram image file to vmlinux when we place it in the tftp folder.
cp openwrt-ar71xx-nand-vmlinux-initramfs.elf /media/sf_TFTP-root/vmlinux
cp openwrt-ar71xx-nand-vmlinux.elf /tmp
cp openwrt-ar71xx-nand-rootfs.tar.gz /tmp

Step 9 - Start the TFTP server
Start the SolarWinds TFTP server application. Go to the General tab under File->Configure. Verify that Storage is set to C:\TFTP-root.
Press the Start button to start the TFTP service.

A quick review now:

• Our Windows 7 laptop (at 10.32.147.10) is running a tftp server ready to serve up the file 'vmlinux'.
• Our Debian VM is running an openssh server ready to serve up the kernel image and file system image from the Debian /tmp directory.
• Our DHCP server (Tomato at 10.32.1471.1) will create an IP address for the RB450G Ethernet plugged into Eth0/Poe/WAN port of RB450G.
• The PXE boot feature of the dnsmasq server on Tomato tells the RB450G to look for the file named 'vmlinux' on the tftp server.
• The RB450G will get an IP address from the DHCP server when it boots and ask the DHCP server the name of the network boot file and tftp server IP address.

Step 10 - Configure the RB450G to Boot from the Network using DHCP
Its time to reboot the RB450G and take a look at the boot prompt screen using Putty from Windows 7. You'll have a couple seconds to press any key after the reboot.  Here we are in Putty after we pressed a key within a couple seconds of the RB450G bootup:

Now we want to convince the RB450G to quit booting from its flash (called NAND) and instead boot from the Network. Press 'o', then 'e'. Press 'o' again to see if you were succesful at getting the Ethernet selected as our boot source: we should see the 'e' as the highlighted selection. The Enter key will exit this submenu.

And we also want the RB450G to use DHCP (PXE boot) instead of BOOTP when it is booting from the network. Press 'p', then '2'. Press 'p' again to verify your success. The Enter key will exit this submenu.

Press 'x' (exit setup) to save your settings and reboot the RB450G.

Now the RB450G is patiently waiting to boot from the network.  If all is configured properly you should see the transfer of the vmlinux start.  If it does not, you can press the Esc key in the console window to force the RB450G to restart the download.

And we end up at the openwrt Welcome Screen:

Step 11 - Backup the Original Mikrotik Kernel and File System Before We Overwrite Them
Just in case we want to go back to the original Mikrotik OS, lets save the data from the original images.

Earlier, we enabled the openssh server on Debian. Ssh will allow us to use the Linux scp command to copy files from the RB450G to our Debian machine. To determine the IP address of our Debian machine, type the following command into a Debian terminal window:
/sbin/ifconfig This will give us the IP address to substitute for some.remote.machine in the commands below

Go to the Putty RB450G console window and type the following commands:
cd /tmp
dd if=/dev/mtd5 | gzip > routeros_kernel.img.gz Small - should take a minute or so
dd if=/dev/mtd6 | gzip > routeros_rootfs.img.gz Large - will take quite a while
scp routeros* user@some.remote.machine:/tmp The 'user' must be your Debian login name

Back in the Debian terminal window:
mkdir ~/RouterOSOriginal
mv /tmp/routeros* ~/RouterOSOriginal

Step 12 - Flash the RB450G

There are two mtd (flash) partitions listed above that we are about to overwrite: the kernel and the rootfs. From the RB450G console:
cd /tmp
scp user@some.remote.machine:/tmp/openwrt\* .
mtd erase kernel
mount -t yaffs /dev/mtdblock5 /mnt
cp openwrt-ar71xx-nand-vmlinux.elf /mnt/kernel
umount /mnt
mtd erase rootfs
mount -t yaffs /dev/mtdblock6 /mnt
cd /mnt
tar xpzf /tmp/openwrt-ar71xx-nand-rootfs.tar.gz
cd /tmp
umount /mnt

Step 13 - Reconfigure the RB450G to Boot from NAND
Don't forget to finish up by going into Putty on your Windows 7 machine, reboot the RB450G and reconfigure the RB450G to boot from its flash: