A Debian Wifi Router: Kernel tuning

So it turns out that if you go with the default kernel parameters on the device you won’t get much throughput. I’m currently paying my ISP for a 25Mbit/s pipe both ways, which is bloody awesome.

I was having problems with throughput and network jitter, though. I was able to have a fast connection from my devices to the router and the router had the full connection available to itself; problems were the router was not able to make the full connection bandwidth available to its clients and the bandwidth would go from 25Mbit/s all the way down to 5Mbit/s all the time.

This is really damn annoying when you’re putting in a good match on Unreal Tournament, let me tell you.

Thinking it could be something related to hostapd I played around with a few more settings but nothing really made a difference. I’m having problems with reception and throughput in my bedroom but that’s for another post, I guess. Suffice to say that with a direct line of sight to the router everything works about as expected.

So it wasn’t hostapd. Played around with iwconfig and iw but neither made much of a difference. That left the network interfaces themselves and the kernel.

Dug around and found plenty of links and articles on what settings to adjust and how to adjust them but all of them are geared towards servers of some sort. There isn’t much information that a home/office IT guy would be able to use for tuning the kernel for bandwidths of less than 100Mbit/s, which is what I’m attempting to do here. The most popular post (which I basically copied into my configuration) is using settings for 1Gbit/s connections that I then changed with the one entry that matched from the Ars Technica post.

Here’s sysctl.conf as I have it right now:

# /etc/sysctl.conf - Configuration file for setting system variables
# See /etc/sysctl.d/ for additional system variables.
# See sysctl.conf (5) for information.
#

#kernel.domainname = example.com

# Uncomment the following to stop low-level messages on console
#kernel.printk = 3 4 1 3

##############################################################3
# Functions previously found in netbase
#

# Uncomment the next two lines to enable Spoof protection (reverse-path filter)
# Turn on Source Address Verification in all interfaces to
# prevent some spoofing attacks
#net.ipv4.conf.default.rp_filter=1
#net.ipv4.conf.all.rp_filter=1

# Uncomment the next line to enable TCP/IP SYN cookies
# See http://lwn.net/Articles/277146/
# Note: This may impact IPv6 TCP sessions too
#net.ipv4.tcp_syncookies=1

# Uncomment the next line to enable packet forwarding for IPv4
net.ipv4.ip_forward=1

# Uncomment the next line to enable packet forwarding for IPv6
#  Enabling this option disables Stateless Address Autoconfiguration
#  based on Router Advertisements for this host
#net.ipv6.conf.all.forwarding=1


###################################################################
# Additional settings - these settings can improve the network
# security of the host and prevent against some network attacks
# including spoofing attacks and man in the middle attacks through
# redirection. Some network environments, however, require that these
# settings are disabled so review and enable them as needed.
#
# Do not accept ICMP redirects (prevent MITM attacks)
#net.ipv4.conf.all.accept_redirects = 0
#net.ipv6.conf.all.accept_redirects = 0
# _or_
# Accept ICMP redirects only for gateways listed in our default
# gateway list (enabled by default)
# net.ipv4.conf.all.secure_redirects = 1
#
# Do not send ICMP redirects (we are not a router)
#net.ipv4.conf.all.send_redirects = 0
#
# Do not accept IP source route packets (we are not a router)
#net.ipv4.conf.all.accept_source_route = 0
#net.ipv6.conf.all.accept_source_route = 0
#
# Log Martian Packets
#net.ipv4.conf.all.log_martians = 1
#
# Kernel parameter adjustments
# 2016/09/12 02:59:32: http://www.nateware.com/linux-network-tuning-for-2013.html
# http://arstechnica.com/gadgets/2016/04/the-ars-guide-to-building-a-linux-router-from-scratch/
#
kernel.sem = 250 256000 100 1024

# Increase system file descriptor limit
 fs.file-max = 100000
#
# # Discourage Linux from swapping idle processes to disk (default = 60)
 vm.swappiness = 10
#
# # Increase ephermeral IP ports
 net.ipv4.ip_local_port_range = 10000 65000
#
# Increase Linux autotuning TCP buffer limits
# Set max to 16MB for 1GE and 32M (33554432) or 54M (56623104) for 10GE
# Don't set tcp_mem itself! Let the kernel scale it based on RAM.
net.core.rmem_default = 4194304
net.core.rmem_max = 4194304
net.core.wmem_max = 4194304
net.core.rmem_default = 4194304
net.core.wmem_default = 4194304
net.core.optmem_max = 40960
net.ipv4.tcp_rmem = 4096 87380 4194304
net.ipv4.tcp_wmem = 4096 65536 4194304

# Make room for more TIME_WAIT sockets due to more clients,
# and allow them to be reused if we run out of sockets
# Also increase the max packet backlog
net.core.netdev_max_backlog = 25000
net.ipv4.tcp_max_syn_backlog = 4096
net.ipv4.tcp_max_tw_buckets = 200000
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_fin_timeout = 10

# Disable TCP slow start on idle connections
net.ipv4.tcp_slow_start_after_idle = 0

# If your servers talk UDP, also up these limits
net.ipv4.udp_rmem_min = 8192
net.ipv4.udp_wmem_min = 8192

# Disable source routing and redirects
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.accept_source_route = 0

# Log packets with impossible addresses for security
net.ipv4.conf.all.log_martians = 1

Everything in here I’m sure can be tuned further and the file itself is so damn ugly to look at but for now at least I have a starting point I can use.

All this tomfoolery is turning me into a network wonk.

A Debian wifi router

The search of a living space has been over for over a month now and I’m more or less settled in. I had a bad experience with my previous landlord keeping my wireless router (an Asus AC-RT68U) cos he’s a fucking asshole so I decided to give this a shot. I’m actively trying to solve money now so it really wasn’t an option to just buy another one as my living costs are now much, much higher.

I’ve hoarded a bit of equipment so I did have a couple of computers available to me. With a bit of looking I found about hostapd and I got it to work more or less reliably on a Thinkpad X220 with an Intel Centrino chipset using the iwlwifi driver. The real problem started when I tried using my older Thinkpad T60 laptop for the same task. Mine has an Intel PRO/Wireless 3945ABG [Golan] chipset also using the iwlwifi driver but the crucial difference was that this chipset doesn’t support Master mode, so you can’t use it with hostapd to enable an AP. Looked around for a bit and tried using this Archer T2UH from Amazon but the support on Linux is a fucking joke, basically; they actually want you to compile the drivers from scratch to get everything going. Ended up with an Ubiquiti Networks SR71-C card using the ath9k chipset. I tried setting it up using the already-installed environment but I couldn’t get it work so I basically reinstalled everything from scratch to start fresh.

I pieced this together from instructions found on the Debian Wiki, this guide from Ars Technica on building your own router, hostapd documentation, and a whole host of blog posts detailing how to pull this off, most of them with information easy to mess up.

As it is right now I’m typing this up on a Windows 10 system connected to the laptop and the signal and throughput are good enough for extended sessions playing Unreal Tournament pre-alpha.

Install Operating System

Installed Debian Stable fresh on the system with no desktop environment. This computer will now be a router so we don’t need any kind of desktop environment. Most desktop environments now require NetworkManager or wicd to manage network connectivity and I wanted to avoid all that crap. It just makes things more complicated for something that will be complicated enough already. I used the netinst install media with the laptop connected to ISP through Ethernet and getting an IP address through DHCP, so I didn’t have to fiddle with any PPPoE clients to get online and install the stuff required.

# aptitude update
# aptitude install hostapd bridge-utils isc-dhcp-server bind9 rfkill vbetool vim-runtime vim-goodies tmux

Enable Wifi Adapter

For some weird and lame reason Debian didn’t enable the adapter after installation, so it has to be setup manually. These instructions are based on the Debian Wiki. Atheros card is wlan0 while built-in Intel adapter is wlan1.

# ip a
# rfkill unblock all
# iwconfig
# ip link set wlan0 up
# iwlist scan

The card scanned for networks around so it was working.

Edit /etc/network/interfaces so the WLAN interface doesn’t wait for an IP address. If you don’t do this it turns out the OS stops booting until it gets bored of waiting for an IP address.

auto wlan0
iface wlan0 inet static
    wireless-mode Master
    address 192.168.1.1
    netmask 255.255.255.0

You can use whatever IP address (like 10.0.0.1) but make sure the same subnet is used throughout the entire configuration. I went with 192.168.1.1 cos that’s what I like my networks to be on.

Configure iptables

Edit /etc/sysctl.conf and uncomment the line for IPV4 packet forwarding:

net.ipv4.ip_forward=1

Create /etc/network/if-pre-up.d/iptables with the following contents

#!/bin/sh
/sbin/iptables-restore < /etc/network/iptables

Then

# sudo chown root /etc/network/if-pre-up.d/iptables ; chmod 755 /etc/network/if-pre-up.d/iptables

Create /etc/network/iptables and put the following in it:

*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
# eth0 is WAN interface
-A POSTROUTING -o eth0 -j MASQUERADE

COMMIT

*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]

# Forward traffic from wlan0 (LAN) to eth0(WAN)
-A FORWARD -i wlan0 -o eth0 -j ACCEPT

# Service rules
-A INPUT -j ACCEPT

# Forwarding rules
-A FORWARD -j ACCEPT

COMMIT

At this point iptables will simply pass along all the traffic that his the computer. I’ve since changed my configuration but this is a starting point as I just wanted to get online at this point. iptables rules are a pain in the ass to type.

Configure DHCP

Edit /etc/dhcp/dhcpd.conf and add the following at the end of the file:

subnet 192.168.1.1 netmask 255.255.255.0 {
range 192.168.1.100 192.168.99.199;
option routers 192.168.1.1;
option domain-name-servers 192.168.1.1;
option broadcast-address 192.168.1.255;
}

Configure DNS

BIND works out of the box, thankfully enough.

Configure hostapd

Create and edit /etc/hostapd/hostapd.conf and put the following in it:

interface=wlan0
driver=nl80211
# SSID on 5GHz band
ssid="MY WIFI NETWORK"
hw_mode=a
channel=44

# Radar an' stuff
country_pre=US
ieee80211d=1
ieee80211h=0

# 802.11n goodness
wmm_enabled=1
ieee80211n=1

# wpa
auth_algs=1
wpa=3
wpa_passphrase=MyWifiPassword
wpa_key_mgmt=WPA-PSK
wpa_pairwise=TKIP
rsn_pairwise=CCMP

ht_capab=[HT20][HT40+][SHORT-GI-40][TX-STBC][RX-STBC1][DSSS_CCK-40]

The ht_capab are the ones I’ve found work with the SR71-C card. I’ll keep playing with them.

At this point everything looked good and rebooted. I actually rebooted a whole bunch of times as I kept prodding and poking stuff every step of the way but I guess it all could be done in one go and just reboot at the end.

Actually be a Wifi Router

After rebooting do

$ sudo hostapd /etc/hostapd/hostapd.conf

Runs with the SSID, picks a channel, and starts the laptop as an AP. iptables is routing traffic from one interface to another, ISC DHCP gives out IP addresses and BIND does DNS. I did run into an issue where wlan0 kept sending out DHCP requests to which dhcpd would successfully assign a new IP address for wlan0. I got lazy and just set a static IP for the mac address of the interface on dhcp.conf. I’ll fix it… eventually.

There’s also the issue of tuning the kernel, firewall and a lot of other stuff since the computer is a single-purpose device rather than a multi-user computer. Most of the documentation I can find is for systems handling traffic at internet scale that would be overkill, so a lot of documentation will be read and a ton of adjustments made.

There will be also a lot of adjustments to hostapd itself to maximize throughput and signal stability. The SRC71C card only does 802.11n but the bitrate on this standard maxes out depending on the blue of the sky, the stage of the moon, how hot the dumpster fires are on twitter and how pissed off the boss is at work.

From what I’m getting this is relatively new stuff when it comes to DIY. People were doing this in the past but was way more costly (like this sweet setup right here). I’m doing this on the cheap and it seems to be working well enough.