Radke Land

Almost a year ago, I volunteered to help set up a couple of IPCop boxes for the purpose of basic firewalling, VPN, and QOS between two sites. I am always leery of building Linux based systems to do the work of embedded devices, since computers (unless you spend extra for them) tend to be less reliable in my experience. One also considers power and moving parts. The end goal was to be able to take any computer with two ethernet ports, and capable of booting from a USB "thumb drive", and turn it into an instant firewall. I struggled much more than I should have, mostly due to my own poor understanding of Linux boot issues, but have finally prevailed. Here is the results of that effort.

IPCop on USB Howto:

Overview:

1. Follow the existing instructions for making a flash based IPCop System
2. Create a custom initrd to preload the necessary USB modules.
3. Modify grub.conf to use your custom initrd.
4. Reboot (test)

Details:

The first task is to install IPCop on a hard disk. There is plenty of instructions out there on how to do this, so no additional details are provided here.

The very first thing to do is follow the execellent instructions in Appendix C of the IPCOP manual (http://www.ipcop.org/1.4.0/en/install/html/mkflash.html). Follow the instructions carefully, as this will generate our base system. Choose a working directory (I used /root), and stay in that directory for the duration of this tutorial.

The next step is to make our custom initrd. The default installation contains mkinitrd, and we'll need to instruct it to preload some modules as well. (Note that the order of the --preload arguments is important!)

root@ipcop: # mkinitrd --preload usbcore --preload scsi_mod --preload usb-storage --preload usb-uhci --preload ehci-hcd --preload sd_mod CustomInitrd.gz `uname -r`

You now have a shiny new initrd to work with. It's a gzipped cpio archive, so we'll need to mount it to do our editing:

root@ipcop: # mkdir tmp
root@ipcop: # gunzip CustomInitrd.gz
root@ipcop: # mount -o loop CustomInitrd tmp

Now we need to (ever so slightly) modify the linuxrc file (which is run in the first stage ramdisk) to give the usb modules time to do their detection before completing the first stage boot:

root@ipcop: # vi tmp/linuxrc

Find the line for mounting the /proc filesystem, it looks likes this:

echo Mounting /proc filesystem
mount -t proc /proc /proc

And right after this, insert the wait:

echo "Waiting for USB devices to come online"
sleep 8

Save and close the file. We need to repack the initrd and put it in the boot partition now:

root@ipcop: # umount tmp
root@ipcop: # gzip -9 CustomInitrd.gz

Let's mount the first partition of the USB which contains the boot information we created when we followed the Flash Based IPCop Systems tutorial, followed by putting the new initrd in place. Assuming your USB stick was recognized as /dev/sda, this looks like this:

root@ipcop: # mount /dev/sda1 tmp
root@ipcop: # mv CustomInitrd.gz tmp

Now we edit the grub boot menu to use the new USB.

root@ipcop: # vi tmp/grub/grub.conf

Near the beginning of this file, find the line that starts with "default", and make sure it reads "default 0". Now ... delete all of the lines starting with the first one that starts with "title", and add your new boot configuration:

title USBBoot
root(hd0,0)
kernel /vmlinuz root=/dev/sda4 acpi=off ro ide=nodma ramdisk_size=655536
initrd /CustomInitrd.gz
savedefault

Save and close grub.conf.

We also (may? I needed to do this, you may not) need to change the device.map, since in a USB boot situation, the USB thumb drive will always be assigned (by grub) as hd0. Note that this is my understanding, and may not reflect reality :).

vi tmp/grub/device.map

You only really need to make sure you have hd0 mapped correctly. There should be only one lines that starts with (hd0), and it should read:

(hd0) /dev/sda

Save and close.

We only have a little bit of cleanup to do, and we'll be ready to go:

root@ipcop: # umount tmp
root@ipcop: # rmdir tmp

Your USB stick should be ready to go. Reboot your IPCop box (optionally removing the staging hard drive before restarting it). You may need to go into BIOS to enable USB booting. When it starts up, just run setup, and get to work!

This was a frustrating but fulfilling endeavour, and I was unable to find a good reference from Google on how to do this. I hope it has been helpful.

- Joshua Radke