Some of you have asked about the lanyard I use with my WLAN Pi R4. So here is how to make yours.
What does it do?
It allows you to ‘wear’ the R4 while keeping your hands free. You can perform 2.4 GHz, 5 GHz or 6 GHz scanning, spectrum analysis, or packet capture from your Mac.
WLAN Pi R4 with 6 GHz Wi-Fi adapter and 6 GHz spectrum analyser as a remote sensor to WiFi Explorer ProWearable WLAN Pi R4
What parts do I need?
My goal is to use a standard conference lanyard. Use your favourite one or order a custom one with your name or company name. In the UK, I use greencotton on eBay and they have been great.
WLAN Pi R4 lanyard, D rings and bolts
After many iterations, I discovered that these D ring picture holders work best. They are made of metal, of perfect size and readily available. So there is no reason to overengineer this or reinvent the wheel.
Finally, we need two M2.5 x 5 mm bolts to attach the D rings to the bottom of the Waveshare heatsink.
D rings attached to WLAN Pi R4Lanyard attached to WLAN Pi R4
WLAN Pi is primarily a Wi-Fi tool, but occasionally I need an iperf server that would be able to deliver more than 1 Gbps of TCP throughput. In a controlled lab environment, I normally use PoE powered NanoPi R5S. I know the IP address of the iperf server by heart. Outside of the lab, I could really do with a WLAN Pi, its preinstalled software, display, buttons and everything it does out of the box. So the question is: “Can we add 2.5 GbE to WLAN Pi M4?”
M.2 slot to the rescue
WLAN Pi M4 doesn’t have any USB 3 ports. How do we add 2.5 Gbps Ethernet to it? If you don’t mind losing the Wi-Fi adapter in favour of 2.5 GbE mGig port, we can install this 2.5 Gbps Ethernet adapter in M4’s PCIe M.2 slot. It is based on Realtek RTL8125B chipset. I paid £17 for it including shipping to the UK.
To my surprise, it just works*. Yes, I hear you, no one likes these asterisks, do you? 😉 Continue reading, it’s not the end of the story.
WLAN Pi M4 with 2.5 Gbps Ethernet2.5 Gbps full duplex
The underwhelming default driver
Linux (and WLAN Pi image) has a driver for this adapter, but upload speeds, that is from iperf client to WLAN Pi iperf server, are very poor. We are talking 300 Mbps poor.
Poor 300 Mbps upload speed
Install Realtek’s latest driver to fix performance
Downloading, compiling and installing the latest Linux driver from Realtek’s website fixes the performance issue. We get symmetric 2.35 Gbps of TCP throughput with standard packet size.
2.35 Gbps of iperf3 TCP throughput
Installation of this driver isn’t as straightforward as it might look. I ended using vanilla Raspberry Pi OS image instead of the WLAN Pi one. Mainly because it is not easy to get the kernel headers for WLAN Pi image and we need them to be able to compile the new driver.
Summary
Yes, it is possible to achieve 2.35 Gbps symmetric TCP throughput on the WLAN Pi M4 with this adapter. But you should be aware of these facts:
This Ethernet adapter doesn’t fit inside WLAN Pi M4 case
You will have to give up the M.2 Wi-Fi adapter in favour of mGig Ethernet
From software perspective, the Realtek driver that ships in WLAN Pi image doesn’t unlock full performance of this adapter (iperf client pushing traffic to WLAN Pi iperf server). Installing the latest driver isn’t trivial on WLAN Pi.
We, WLAN Pi team, currently don’t support this setup. If you have a use case for 2.5 GbE support on the M4, please let us know.
You might remember me saying something about designing a 3D printed WLAN Pi tripod mount. Yes, that was the plan… until I found a much better solution, which I had already owned.
Why tripod mounted? Well, occasionally I work on an outdoor Wi-Fi project. WLAN Pi can be a really useful for throughput testing, or it can share your phone’s cellular internet connectivity with your access point. This is really useful in cloud-managed surveys, labs, and projects.
Tern RidePocket Handlebar Bag
I present to you this small, well designed, and weatherproof Tern RidePocket bag. It is a fantastic bicycle bag, and as good bag for your WLAN Pi. You can purchase one in many countries around the globe and made by a big bike company, which is here to stay.
WLAN Pi in the Tern RidePocket bag on a tripodWLAN Pi powered by PoE using PoE splitterCable management works really well
If you wanted to, you can battery power your Pi. Just add a battery pack of your choice.
WLAN Pi powered by a USB battery pack
Outdoor surveys involve all kinds of weather, and that’s where this rain cover becomes really useful.
Rain cover
What makes it work better than other or cheaper bags? It mounts securely, and does not slide down the tripod thanks to its strap coated with a layer of anti-slip rubber material.
Anti-slip material on the strap and a hook towards the topAttached to a tripodCloser look at the cable hole
If you prefer a Raspberry Pi 4, or WLAN Pi Community Edition based on Raspberry Pi 4, it fits in this bag too including a PoE splitter with little effort.
It fits Raspberry Pi 4 and PoE splitter
Lenlun Bike bag set
Do you need to interact with your WLAN Pi while it is mounted? No problem. I’ve tested a handful of other bags and Lenlun Bike bag set is the best fit. It allows you to see the display and press buttons while it protects everything stored inside.
WLAN Pi in the Lenlun bagWLAN Pi in the Lenlun bagAttachment to tripod is not as clean as TernBattery pack and WLAN Pi inside the bag
Finally, after you are done working, these bags can happily carry your keys, phone, battery pack, and wallet.
By default WLAN Pi, and Linux in general, uses a username and password-based SSH authentication. It involves quite some typing, some brain capacity to remember the password, and it is not the most secure method either.
You can create a public and private key pair. Your SSH client automatically logs in using the private key. The SSH server uses the public key to confirm that you possess the right private key. No password needed, and it also is more secure. The private key is never sent over the network, and this method protects you against man-in-the-middle attacks.
The beauty of this GitHub method is that GitHub stores your SSH public key centrally, which you can easily update, and you can install it to the machine you want to SSH to, by a single command ssh-import-id-gh. You can even add this to a startup script so that it automatically updates your trusted keys.
Let’s do this
ssh-keygen is the program that generates a public/private key pair on your local system. The private key is stored in ~/.ssh/id_rsa, and the public key is stored in ~/.ssh/id_rsa.pub.
The security of this method depends on keeping the private key safe and secure. Make sure not to leave the private key behind.
ssh-keygen -t rsa -C "your@email.com"
Generating public/private rsa key pair.
Enter file in which to save the key (/Users/jiri/.ssh/id_rsa):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /Users/jiri/.ssh/id_rsa
Your public key has been saved in /Users/jiri/.ssh/id_rsa.pub
The key fingerprint is:
SHA256:.....
The key's randomart image is:
+---[RSA 3072]----+
.....
+----[SHA256]-----+
Display the public key, which is a text file at the end of the day, and copy its content to clipboard:
cat ~/.ssh/id_rsa.pub
ssh-rsa
.....
Save this public key to your GitHub account. Browse to github.com, log in, and open Settings:
Click New SSH key, name the key, paste your public key from the clipboard and save it:
The last step is to SSH into your WLAN Pi or Linux machine and tell it to use this public key from my GitHub, where jiribrejcha is my GitHub username:
ssh-import-id-gh jiribrejcha
If the command isn’t installed, you can fix that by:
sudo apt install ssh-import-id
Passwordless SSH access
When you authenticate to a server using public key authentication, the SSH client offers a copy of the public key to the server and the server then compares it against the keys listed in your ~/.ssh/authorized_keys file. This key was added automatically by the ssh-import-id-gh command. If the key matches, the server indicates that it is able to proceed with the authentication. The private key is then used to sign a message that includes data specific to the SSH session. The server can then use its copy of the public key to verify the signature.
We have just SSH’d to the Pi without a password prompt.
Up until now, you could only use the WLAN Pi display to see its IP address and other IP details. If you are on the same subnet you could do ping wlanpi.local. Alternatively, your DHCP server log or show ip arp on the access switch could tell you.
Telegram Bot for the WLAN Pi automates the whole process and it sends you the IP details of your WLAN Pi whenever the Pi comes online. You can then easily and remotely skim through the details, check its IP address, public IP address, current mode, uptime, switch and port details the WLAN Pi is connected to, or double-check that its Ethernet adapter successfully negotiated 1 Gbps Full Duplex.
And you can do all this from you wrist, phone, tablet or laptop.
How to enable Telegram Bot
Download WLAN Pi image 2.0.1 or newer. Flash it onto an SD card. Boot up from this SD card.
Create a new Telegram account if you do not have one already. Start the Telegram app.
Let’s create a new Telegram bot. Find a person called Botfather and send them a message saying /newbot.
Follow the instructions to create a new bot.
After the new bot is created, copy the API key to a text editor.
Start a new chat with the newly created bot and say Hey, Hi or something like that and welcome them to the blue planet. This is mandatory and you can send more than one message.
Now SSH to the WLAN Pi and run this command with root privileges sudo telegrambot
It will complain about missing API key and tell you where to paste it.
Edit the configuration file, uncomment the second line and paste your own API key from step 5 using sudo nano /etc/networkinfo/telegrambot.conf.
Save the file using CTRL+o (letter o) and exit the editor using CTRL+x.
Make sure you sent a Telegram message in step 6 to your new bot.
Connect your WLAN Pi to the internet.
Finally, reboot by sudo reboot
Multiple Pi’s can use the same API key and send their IP configurations to the same chat or you can have 1 chat per WLAN Pi (my preferred option). It is completely up to you.
How often are Telegram messages sent?
Every time the WLAN Pi reboots and has internet access, it will send a new message to you.
If internet connection goes down (for example when you disconnect the Ethernet cable, DNS server stops responding or something breaks at your ISP while eth0 still remains up) for more than 10 seconds, the WLAN Pi will send you a new message with its fresh details after the internet connection goes up again.
Send a new message manually
Assuming you have completed the setup using the above instructions, you can SSH to the WLAN Pi at any time and send a new Telegram message manually using sudo telegrambot.
How to troubleshoot
If you are not receiving any message from the WLAN Pi, send another message to the Telegram bot using the Telegram app and reboot the Pi.
You can also check the logs and grep for telegrambot: sudo cat /var/log/messages | grep telegrambot
You may have used DHCP Option 43 to point an AP to its controller before. But only very few people know that Cisco APs can automatically convert themselves from the built-in controller mode (think Mobility Express or Embedded Wireless Controller) to Lightweight mode after they receive a special Option 43 from a DHCP server.
If you have a pallet of access points (or routers with built-in Wi-Fi in Mobility Express mode) next to your desk and need to convert all of them to Lightweight mode, simply configure DHCP Option 43 in the following format on your DHCP server and plug them into a PoE capable switch. After the APs boot up and receive the option from DHCP server, they automatically switch to the Lightweight mode and attempt to join the configured controller (192.168.130.2 in our case).
Option 43 format used for AP conversion
f2:05:c0:a8:82:02
“f2” tells the AP that we want it to switch to Lightweight mode
“05” means that only one controller IP address will follow
“c0:a8:82:02” is the controller IP address (192.168.130.2 in this case) in hexadecimal format, search for “IP to Hex Converter” if you do no want to do the math
Cisco IOS/IOS-XE DHCP server configuration
You can run DHCP server on a Catalyst switch. The DHCP scope configuration is straightforward.
ip dhcp pool <pool name> network <ip network> <netmask> default-router <default-router IP address> dns-server <dns server IP address> option 43 hex f205c0a88202
WLAN Pi, Raspberry Pi and any other Linux ISC DHCP server configuration
Special thanks to Nicolas Darchis, who helped me find the “vendor-encapsulated-options” option. It lets you enter Option 43 in the hex format and all it takes is a single line of DHCP server configuration.
If your DHCP server runs on a Cisco Meraki MX appliance, you can easily configure Option 43 using Dashboard. Here are the instructions.
Packet capture or it did not happen
Here is the DHCP Offer packet with the special Option 43 value sent from DHCP server to the APs. They will start the conversion automatically after receiving it.
Verify successful AP conversion to Lightweight mode
Console to one of the APs and you will notice this message:
[*08/25/2020 23:24:39.5620] Last reload reason : 2: AP type changed from ME to CAPWAP
Or you can let the AP finish its job. And then verify successful conversion to Lightweight mode whenever you are ready using the “show version” command.
9120#show version <output omitted> 9120 uptime is 0 days, 0 hours, 5 minutes Last reload time : Tue Aug 25 23:24:39 UTC 2020 Last reload reason : AP type changed from ME to CAPWAP <output omitted>
There is great document explaining how to configure Option 43 on ISC DHCP server on the Cisco website.
If all you need is a simple DHCP server which will assign Option 43 to all devices on the network, without selectively assigning it only to specific AP models using the class construct, you can simplify your ISC DHCP server configuration to this. It works great on a WLAN Pi.
Configuration
# Linux ISC DHCP server configuration in /etc/dhcp/dhcpd.conf
option space Cisco_LWAPP_AP;
option Cisco_LWAPP_AP.server-address code 241 = array of ip-address;
# eth0 DHCP scope
subnet 192.168.73.0 netmask 255.255.255.0 {
interface eth0;
range 192.168.73.100 192.168.73.200;
option routers 192.168.73.1;
option domain-name-servers 208.67.222.222, 208.67.220.220;
default-lease-time 86400;
max-lease-time 86400;
vendor-option-space Cisco_LWAPP_AP;
option Cisco_LWAPP_AP.server-address 10.10.10.10, 10.20.20.20;
}
Verification
The access point will get its IP configuration from the DHCP server including Option 43 and will try to join these controllers.
We have all been there. It is the night before an important training or meeting and you need to install few more packages on your WLAN Pi or push some code changes to GitHub. Guess what? There is no wired connection available in your room and the hotel Wi-Fi uses a captive portal or is very poor.
iPhone USB tethering on the WLAN Pi lets you use your iPhone or iPad as a cellular modem and share the internet connectivity with the WLAN Pi. It also charges your iPhone, which is nice.
How to enable iPhone USB tethering on WLAN Pi
Simply follow these steps:
Connect to the WLAN Pi using SSH and run this command. Do not skip this step, it is required: sudo apt-get update
Then install this package: sudo apt-get install usbmuxd
Plug your iPhone into the WLAN Pi using a lightning to USB-A data cable.
On the iPhone, go to Settings > Personal Hotspot > Allow Others to Join.
A new eth1 interface will appear on the WLAN Pi.
Tap on the Trust button on your iPhone/iPad and enter your passcode.
After you click Trust, the eth1 interface will get a dynamically assigned IP address by the DHCP server running on the iPhone.
Your WLAN Pi is now connected to the internet. You can verify using the Reachability tool in the Front Panel Menu System (FPMS). Go to Menu > Utils > Reachability.
Share iPhone internet connection with multiple devices on you LAN
You can even take this one step further. Perhaps you have multiple other devices connected to a switch and you need to provide temporary internet connectivity to all of them. That is where the USB Tethering mode comes to the rescue.
The easiest solution is to tweak the existing Hotspot mode on your WLAN Pi. In most cases we will replace wlan0 with eth0 and eth1.
Before you start, please backup all these files or ideally start with a fresh SD card and fresh WLAN Pi image.
Edit this file: sudo nano /etc/wlanpihotspot/default/isc-dhcp-server
Update this line to: "INTERFACESv4="usb0 eth0"
Edit this file: sudo nano /etc/wlanpihotspot/dhcp/dhcpd.conf
Update this block to: # eth0 DHCP Scope subnet 192.168.88.0 netmask 255.255.255.0 { interface eth0;
Edit this file: sudo nano /etc/wlanpihotspot/network/interfaces
Update these lines and comment some out: allow-hotplug eth0 iface eth0 inet static #Wired ethernet #allow-hotplug eth0 #iface eth0 inet dhcp
Edit this file: sudo nano /etc/wlanpihotspot/ufw/before.rules
Update this line to: -A POSTROUTING -s 192.168.88.0/24 -o eth1 -j MASQUERADE
However strange it sounds, plug a supported Wi-Fi adapter into a USB port of your WLAN Pi. Without the adapter plugged in, the WLAN Pi will not switch from the Classic mode to the Hotspot mode.
Now go to Menu > Modes > Hotspot > Confirm
Your WLAN Pi will reboot. Disconnect the Wi-Fi adapter, we do not need it anymore.
The WLAN Pi will do PAT (Port Address Translation) on its eth1 outside interface. On the inside eth0, it will start DHCP server and share the iPhone cellular internet connection with all devices on your LAN.
Here is a traceroute output from one of the devices connected to the switch. First hop to the internet is WLAN Pi’s eth0 interface and second is the iPhone’s inside interface.
A word of caution
While this new mode is a great feature, it can potentially cause some harm. Please read before you tweak.
In this mode, WLAN Pi runs DHCP server on the built-in eth0 interface. At no circumstances you want to plug it to an existing corporate network and especially one which is not under your management. Your WLAN Pi might take over clients of the existing DHCP server and route all traffic via the cellular connection. If you have not already, I highly recommend you enable DHCP snooping on your switches. This is a security feature and will block untrusted DHCP servers connected to your network.
Double-check that your data plan is suitable for tethering. Your mobile operator will charge you for the cellular data services.
You are potentially opening a backdoor to the existing LAN network over the cellular connection.
Always switch your WLAN Pi back to the Classic mode before shutting it down. Next time you use it, it will boot up to the Classic mode, which is safe by design.
Your feedback counts
If you find this feature useful, let us know. Perhaps a new “USB Tethering” mode might be a nice addition and will save you time editing the configuration files manually.
Although the WLAN Pi team implements most of the new features into the official image, it also assesses all security aspects. At the end of the day, everyone’s goal is to maintain high standards.
My setup
I have successfully tested this setup with iPhone 8 Plus and WLAN Pi NEO2 Black running 1.9.1-RC2 release. Please add a comment to this post with your setup so that we know what has been tested and works.
