All of us at EchoDitto are big fans of the FON project — we run a FON access point here at the office, and I run one at home even though my primary router is a much-more-capable WRT54G running an old version of the Sveasoft Linux firmware. I got my Fonera router from Phil, so I assume he's running a FON AP, too. We're trying to support the project — honest!

I say all this out of guilt. Last night I hacked a Fonera. I know, I know — they sell these things for next to nothing only so that they'll get distributed and the project will grow. But I don't have any more WAN pipes available to share! So I hope the project's sponsors will forgive me for succumbing to the siren song of $10 Fonera routers on eBay. I couldn't help myself from checking out what a spare unit can do.

"Kind of a lot" turns out to be the answer. The La Fonera is based on the Atheros chipset, which is found in a number of other commercial routers and supported by both the DD-WRT and OpenWRT firmware projects.

Sveasoft kicked off the custom router firmware scene, but the author's controversial attitude toward the GPL made them fall out of favor rather quickly. Besides, truly open efforts quickly outpaced the project. OpenWRT is the king of functionality, but also the most intimidating — they seem to have a general "GUIs are for chumps" sort of attitude. While I aspire to similar levels of snobbery, I'm more comfortable sticking with projects that have support forums filled with posts that are comprehensible to someone just getting started with the project.

Besides, I've had great luck with DD-WRT in the past, using it to successfully repeat a neighbor's faint wifi signal through my girlfriend's apartment (with permission, of course — but without having to do anything to his router, i.e. no WDS).

The project can do a number of other cool things, too. There's the requisite SSH server and cron job support, the DHCPd tricks to be had and rock-solid stability. But there's more: you can run PPTP or OpenVPN private networks; the JFFS package makes the spare space in the flash memory area available as a filesystem; an SMB client library allows you to mount remote volumes for much more storage; wget and other utilities are precompiled; you can run a SIP proxy on some DD-WRT builds; and if you get the ipkg manager working, the world's really your oyster, as minified versions of Perl and Ruby become available (memory permitting). There's even a Bittorrent client with a web frontend available. And Asterisk. Did I mention Asterisk?

Of course, the FON people would prefer that you stick to using their own firmware. They're doing their best to make sure you do: early versions of their routers were relatively easy to upgrade thanks to the router's unencrypted chats with its config server and some administrative forms that were only secured against injected shell commands by Javascript. But my newly acquired router was the 2200 model — their most recent router, so far as I can tell — and none of those vulnerabilities are present in it.

There's still one working exploit, though — you can give the thing a static IP and point it at a malicious DNS server that sends it toward an impostor RADIUS box. Some nice folks in Germany have even taken the time to set up and maintain such a DNS server. It's a good thing, too, because the rest of the DD-WRT installation on the 2200 still takes a bit of effort.

• You can find basic instructions here. These are what we'll be primarily working from.
• As mentioned the HTML injection trick doesn't work any more, so focus on using the DNS exploit. In short, you set your Fonera's DNS to 88.198.165.155, then can SSH in (supposedly after a reboot — I didn't have to, though). If you'd like a detailed explanation of how this and other Fonera exploits work, head to the responsible geniuses' site (complete with a graph of how many Foneras have dialed in to their server).
• You may get a little confused about what DD-WRT distribution to use — they release several flavors across several architectures, and do so often. My advice is to use these files. If you want to upgrade to the latest bleeding-edge Fonera beta, do so afterward when you have a working upgrade interface.
• When you get to all the "fis init" business, be prepared for errors. I certainly got 'em, and it looks like I'm not the only one. This was frightening at the time, since these steps involve actually overwriting the flash memory of the router. The flashing process had gotten stuck and I'd been forced to do a hard reboot — a fantastic recipe for turning any appliance into a brick. Luckily, the telnet-accessible shell remains accessible, and on the second try everything worked. Other users in the aforelinked thread report similar experiences, so my theory is that some lingering bit of FON code generates errors as it's being overwritten (this occurs during the "load -r -v -b 0x80041000 root.fs", to be exact). The second time's the charm, though. You'll see some less terrifying error messages during the later phases of this flash memory monkey business, but it seems to be safe to ignore them.

Once you get through that part, you're pretty much out of the woods. You've got a functioning copy of DD-WRT, albeit one with somewhat more limited capabilities than you might enjoy on a beefier router. Go ahead and change the root password, enable JFFS2 (with the "clean" option, which will format the new partition for you) and adjust whatever other options you'd like. There are a lot of them.

This brings us to why I actually wanted to screw around with the router. It wasn't to have another copy of DD-WRT, awesome though it may be. My routing needs are pretty well satisfied. No, I wanted it for my Arduino.

Wifi interfaces for physical computing are expensive. Check out SparkFun: their 802.11b modules start at $124.95! You can buy a wired solution like Lantronix's XPort, but they're about as expensive as the Arduino. And, of course, they come with wires. Nobody likes wires.

But if you could use the DD-WRT-enabled Fonera you'd be getting an 802.11g client AND an ought-to-be-Arduino-compatible 7.5V power source (note: I haven't tested this) for as little as $10! Once you pull off the Fonera's case it's not much bigger than the Arduino, either. Better still, the Fonera has a Linux environment in it, providing all sorts of capabilities. It's actually considerably more powerful than the Arduino; I just want the Arduino for its PWM capabilities (I'm hoping to drive some VU meters with data from the net).

So how do you get this working? Well, first set up the Fonera's DD-WRT build to act as a wifi client, so that it's ready to use whatever wireless network will be serving it data. Head to the wifi settings and change it to "Client Mode". Set the SSID to the name of the network you want it to join. If it's a secured network, head to the security tab and make sure the physical interface's encryption settings match those of the network you're joining. You'll probably want to head to the General settings area, too, and assign the unit a static IP address so that you can SSH into it easily from the parent network (or use DHCPd on that network to ensure the Fonera gets a consistent IP).

If you'd like, add a Virtual AP in the wifi settings. This will make the Fonera advertise another SSID, which can be bridged to the parent network — handy, huh? Be forewarned that it takes forever for the virtual AP to come online after a reboot. You may also need to switch the physical interface to "Client Bridge" mode. I didn't play around with this too much because a) it's irrelevant for my purposes and b) I've gotten it working under DD-WRT with different hardware in the past. From what I've read this capability has only come to the FON build of DD-WRT recently; caveat emptor.

At any rate, you should eventually be able to cajole the Fonera into joining the same wifi network that you're using to read this. Make sure you can SSH into it... then begin plotting.

How will we connect the two devices? Well, I'm still working that out. There are a number of general purpose input/output (GPIO) pins on the Fonera, although they're less convenient on the 2200 than they have been in previous iterations. They can still be bent to our purposes, though, and, with a little careful soldering, made to interface with the electronic systems of our choice (this is how people — crazy people — add SD card storage to their routers).

To see what I'm talking about, try running this from an SSH session as root, while keeping your eye on the router's power LED:

echo 0 > /proc/gpio/7_dir
echo 1 > /proc/gpio/7_dir

It should turn the power LED off and on. Slick, huh?

You can find more pinout details here, and pictures of the actual contacts (which I rescued from Photobucket — apologies to the author) here. Soldering into those points lets you send I/O through the Linux shell on the Fonera. And given that there's a working cron system in place, some scripts can easily be cobbled together to monitor a remote resource and manipulate the output accordingly. You can see a hilariously dangerous example here (NOTE: sending 110VAC through a transistor is NOT a great idea).

But the 2200's pins are pretty restricted, and so far I haven't been able to figure out how to make the WLAN pin useful: it responds to commands but is also receiving them from DD-WRT's activity monitor, which seems unlikely to work very well.

More tantalizingly, the unit also has a serial interface. It looks like I might have luck simply plugging my Arduino RX to the Fonera's TX (and vice versa — or maybe not). I shouldn't need a level-shifting chip like the MAX232 at the link since it's all TTL. It would be pretty great to have my Arduino periodically log in to the Fonera, prompt it to pull down whatever stats I want (likely amassed on a server) and then parse the results and output them to the analog display of my choice.

I haven't had a chance to try this yet, but I'll be sure to let you know how it goes when I do.

UPDATE: This looks promisingly similar to what I want to do, although the author uses serial-over-USB, which isn't an option in this case. Still!