South Park, Golden Villas

 Golden Villas Affordable Housing

Background 

Golden Villas is an affordable housing location in South Park, San Diego. it has 44 dwellings in 11 buildings, and a community room. A local non-profit manages the housing. The residents are a broad demographic and are mostly families with children.

In Feb 2005, Socalfreenet volunteers descended en masse and installed two rooftop access points, a gateway sharing and firewall device in the office to provide wireless coverage for the entire complex.

At the same time, they also completely cleared out the disused community room and installed a complete computer lab with six computers donated by the San Diego Futures foundation. 

 Results

This has been a flagship installation. Most of the residents here use the internet, as well as many surrounding houses. The system has been incredibly stable, with outages measured in minutes per year.

Golden Villas Installation Planning

Note: This document was a 'living' document during the planning phase, and as such was never quite up to date. And so far it has not been updated to reflect the final outcome on the installation day. However we're leaving it here in this state to serve as a guide for the next install and/or interested readers. Please don't mistake it as "The whole truth and nothing but the truth.".


This document is a central planning document for the Golden Villa installation day. The address is
http://maps.google.com/maps?q=3385%20Elm%20St%2C%20san%20diego%2C%20ca and the start time is 10am.

The installation has four parts:

  1. Installing the main wireless node above the office
  2. Installing the repeater wireless node
  3. Installing and configuring the common room computer lab
  4. Helping residents get online

Below are the details for each part of the installation.

Main Wireless AP and Office Router

Requirements

The main AP will be located on the peak of the roof which contains the office. The AP will be mounted directly on the wall and the antenna will be in a short pole screwed directly onto the roof peak. A supplied Cat-5 cable will run down the roof and through a new hole into the office where it will be connected to a router which will split the cable internet between the office network and wireless network.

The network configuration is detailed here and there is a separate step by step covering the m0n0wall configuration and Netgate HS3000 AP configuration.

Challenges

  • The 50ft pre-made cable supplied with the AP might be too short to go all the way from the rooftop to the office, and it has a proprietary plug on one end. We may have to join the cable outside.
  • The AP has a mounting plate that we should be able to mount directly to the wood face board, but if not, we may need to mount all the equipment on the pole.

Equipment List

The following equipment has been purchased for the installation:

Netgate HS3000 which includes a 50 ft outdoor cat-5 cable
SuperPass 8dBi 10 degree downtilt omni
Hyperlinktech Lightning Protector
Soekris 4501 in case with m0n0wall

Still to be Done

Purchase a drill bit to put the cable through the office wall
Purchase sealant to fill the hole after we put the cable through
Solve the problem of extending the ethernet cable if necessary.
Configure the MikroTik
Configure the AP

General Comments

Wireless Repeater

Requirements

The second wireless AP will be mounted at the other end of the complex. It will operate in repeater mode.

Challenges

  • The 50ft pre-made cable supplied with the AP might be too short to go all the way from the rooftop to the office, and it has a proprietary plug on one end. We may have to join the cable outside.

Equipment List

The following equipment has been purchased for the installation:

Still to be Done

General Comments

Computer Lab Installation

Requirements

We will receive 6 computers running fresh installations of either Win2k or WinXP, complete with keyboard, mouse and monitors. They need to be hooked together into a switch with a D-Link kit which will get the signal from the main AP.

Equipment List

The following equipment has been purchased for the installation:

D-Link Bridge Kit to hook up the lab to the network
Cat-5 cables

Still to be Done

Need an 8 port hub
Need a few power strips
Pick up the donated computers

General Comments

Resident Installation

Requirements

Challenges

Equipment List

The following equipment has been purchased for the installation:

Eight D-Link Kits - already programmed for socalfreenet.org (thanks John Kim!)

Still to be Done

General Comments

Home Depot Shopping List

Ground lug
"U" clamps and matching wood screww
Radiator clamps

Golden Villas - HS3000 Configuration

Here is a brief description of how we configured the two Netgate HS3000 250mW APs we're using at Golden Villas.

Setup is very much like configuring any AP, but with one twist - adding the WDS (Wireless Distribution System) setup. The basic steps are:

  1. set a startic IP on your computer such as 192.168.2.100 (255.255.255.0)
  2. connect to the HS3000 via ethernet, turn it on, etc.
  3. connect an ethernet cable from your computer to the HS3000 - a crossover cable is needed for a direct connection
  4. open a browser at http://192.168.2.254, no password is needed
  5. Under the wireless Basic Settings, set:
    • Mode: AP
    • SSID: socalfreenet.org
    • Channel 11 - channel 6 is invariably busy so we typically use either 1 or 11. At this location there wasn't much activity on any channels during the site survey
    • Apply Changes
  6. Under the Wireless Advanced Settings, we bumped the power up to 250mW (24dBm) but left everything else at the default

At this point we stopped to check that everything was working ok via wireless. Note that the AP resets between almost any setting change, so there is a pause and lost connection during this period.

Next we configured the LAN settings to match the network design, as follows:

  1. Click on TCP/IP settings
  2. set IP address to 10.12.11.130 (and 131 for the 2nd radio)
  3. subnet mask is 255.255.255.129 (/25)
  4. default gateway is 10.12.11.128 (_though this is probably not used_)
  5. DHCP was left disabled

At this point, of course, you need to switch the computer IP used. We actually plugged into the previously configured m0n0wall box and connected wirelessly. The m0n0wall gave us an IP and after going through the captive portal we could surf the net as hoped.

The last step was to turn on WDS support. The HS3000 requires that both "master" and "repeater" be set to point to each other. A convenient way to get the required MAC addresses is to use the Wireless Site Survey link, assuming both radios are on. Of course there are also stickers on the metal case and on the box they came in.

  1. Click on Wireless -> WDS Settings
  2. Check the Enable WDS option
  3. enter the MAC address of the other radio
  4. click on Apply Changes
  5. repeat for the other radio

Now you're ready to test. This turned out to be a little tricky. Most client software doesn't give you any control over which AP you connect to and may even ping-pong between APs. So not only is hard to force the client to use a particular AP (e.g. the repeater instead of the master), most software won't even tell you the MAC address of the AP you're connected with. Before we worked out the test technique below we saw a lot of strange behaviour. Very slow links, dropped packets etc.

Skipping to what worked, we turned on the master AP but left the antenna disconnected (key step!). A few feet away we put the 2nd 'repeater' AP with its 8dBi omni connected. Then we took a laptop a few rooms away - i.e. far enough for the master to be too weak, but a good signal from the repeater was available. (This proved much better than our first approach of leaving both antennas on and taking the repeater AP a few rooms away.

It was interesting to start a ping to both radios and watch the results. From two separate pings to 10.12.11.130 and 10.12.11.131 the ping time for the connected radio was 1-2ms and double that for the other. As we walked away with the laptop and the client software switched from the master AP to the repeater, the pings first started timing out and then the times reversed with the shorter time for the repeater.

After the above we were satisfied that we had the network ready to install. Phew!

Golden Villas - m0n0wall configuration

Here are the steps taken to program monowall for use at Golden Villas apartments with a Soekris 4501 box. Read the Network Configuration in conjunction with this guide.

The latest version of m0n0wall available was used, 1.2b3. It was configured as follows.

  1. Interfaces -> assign: add the third interface and enable it
  2. Rename the interfaces: LAN, WLAN and WAN and assign to sis0, sis1, sis2 respectively
  3. set the LAN IP to 10.12.11.1/25
  4. set the WLAN IP to 10.12.11.129/25
  5. leave WAN at DHCP as the cable modem will be DHCP
  6. Under Services -> DHCP:
    • set LAN range to 10.12.11.50 - 10.12.11.99
    • set WLAN range to 10.12.11.154 - 10.12.11.250
  7. Under Sytem -> General Setup:
    • Change hostname to goldenvilla
    • change password
    • set webGUI protocol to https
    • set timezone to America/Los_Angeles
  8. Under Firewall -> Rules, click on the LAN tab (if not already selected). Then click on the + sign next to the rule that has the description "Default LAN -> any". This will create and go to edit mode a new rule with the same settings. Then change:
    • Interface: WLAN
    • Source: WLAN subnet
    • Description: Default WLAN -> any

That's the important settings completed. Everything should basically work at this point and its worth stopping to make sure.

We want to keep the LAN completely firewalled from the WLAN so we need some rules to ensure that it is:

  1. click on the Firewall -> Rules -> WLAN tab
  2. click 'e' next to the WLAN rule that allows all traffic anywhere
  3. under Destination check the 'not' box and then select Lan subnet from Type
  4. tweak the description (e.g. add ", except LAN")
  5. Click Save
  6. Click Apply Changes

Unfortunately now we can't admin the firewall via wireless on the WLAN, so we add another rule. We make this rule very specific:

  1. click on the Firewall -> Rules -> WLAN tab
  2. click '+' next to the WLAN rule that allows all traffic anywhere
  3. change Protocol to TCP
  4. change Destination to Type "Single host or alias" and the address to 10.12.11.1
  5. set the Destination port range to HTTPS
  6. tweak the description, e.g. "Allow WLAN admin access"
  7. Click Save
  8. now move the new rule to the top by checking the empty box against the new rule and the click on the left arrow against the first
  9. Click Apply Changes

At this point it shold now be possible to access https://10.12.11.1 from a client on the WLAN port (i.e. a wireless client once WLAN is connected to an AP).

Some more settings will complete the configuration:

  1. Under Diagnostics -> Logs -> Settings
    • set remote syslog server IP
    • check "Show log entries in reverse order"
  2. fill in the Firewall -> Traffic shaper -> Magic shaper wizard settings and enable the traffic shaper. Check both options - share bandwidth evenly and set P2p to lowest priority
  3. configure Services -> captive portal:
    • enable captive portal
    • interface WLAN
    • idle timeout: 60 mins
    • hard timeout: 1440 mins (24 hours)
    • add the portal page - see file attached to this page
  4. click on Services -> captive portal -> Allowed IP addresses and allow www.socalfreenet.org to be visited without authentication
    • select "To"
    • add IP 216.193.213.171
    • desription: www.socalfreenet.org

That's it! Save the configuration just to be safe (under Diagnostices -> Backup/Restore).

Golden Villas Site Survey Report (South Park)

South Park Site Survey - Main Antenna LocationDrew, Seren, Jason and Michael did a site survey today at Golden Villa affordable housing apartments. Here's the report.

Results Summary

Two access points mounted at each end of the L shaped layout should be sufficient to provide adequate coverage throughout the complex. The buildings are 2 story with 4 units per building and attenuate the signal markedly. However the proposed AP layout allows most units in the buildings to receive a direct signal.

For equipment, we could either go our usual route and have a main AP with both 802.11a and 802.11b radios and a second AP relaying from there. Total cost approx $1300.

Alternatively, we could use a WDS-based solution either based on an inside AP-160 and two Sputnik AP 200 or the Netgate HS3000 (both about $900).

In addition, in the main office we'd either place an embedded PC running m0n0wall or a Sputnik 160 is possible if we go the WDS route.

In short, we could build a system for all 44 occupants and the computer lab for $1000 - $1500.

We saw 4-5 APs during out site survey - much fewer than normal.

Layout Details

The buildings form a rough L shape, with the office located on the leg of the L but towards the corner. It is wrapped around a road on the inside of the L with a gorge on the outside all around. Single dwelling houses are on the opposite side of the road.

The office has an existing Cox business cable connection and is the rooftop we used to place the test equipment (there are also 4 apartments in the building). The test AP was a 200mW Senao CB3 plus, http://www.wlanparts.com/product/NL2611CB3PLUS, with an 8.5 dBi 10 degree downtilt antenna, http://www.superpass.com/SPDG6O-D10.html. Right opposite the office is a community building where they plan to create a small computer lab.

South Park Site Survey - Rooftop View 1 South Park Site Survey - Rooftop View 2 South Park Site Survey - Rooftop View 3

Testing details

With three laptops containing various combinations of built-in (Centrino) and external cards (30mW Atheros-based Netgear and 50mw? D-Link non-prism) we walked around all the buildings while running a continuous 1500 byte ping to the AP. When the pings started dropping we marked that as the edge of useful range.

Using this criteria, we determined that over half the buildings could be covered with one AP. Two remaining buildings had incomplete coverage. Some of those apartments could get good coverage from their front windows, but not beyond. Assuming the same propagation, we concluded that another AP mounted on the last roof of the tip of the L, but closer to the L corner would provide the whole complex with good coverage. The houses across the road on the inside of the L would also get good coverage, and likely the houses across the gorge (though there weren't many, and the downtilt makes it less likely).

Mounting details

South Park Site Survey - Utilities and Power for Second AntennaNone of the rooftops are flat. We decided that mounting a standard L shaped bracket like that used for satellite dishes on the end of the building at the peak of the roof would be simple and effective and allow the antenna to rise about 1 foot above the roofline. We could route outdoor Cat-5 cable to the roof via the water downpipes which are open at the bottom and then up to the box following side roof trim panels. A tall ladder will be needed for the installation day.

At the office location we will need to drill through the office walls like cable TV installers do. Inside will be power and the internet feed.

At the other building location the power box has a double outlet underneath the main meter box (5 meters - 4 units plus 'house'). We would need to add a water-resistant housing for the PoE. A simple 4x4x4 electrical box would suffice and could be mounted directly on the wall (perhaps even surrounding the double outlet box?).

Dirt surrounds all buildings so driving a grounding rod for lightning protection should be straight forward.

Pricing details

Standard relay:

$ 40      - 2 x LMR-400 N-male N-male cables
$ 20      - lightning arrestor
$ 45      - PoE
$ 65      - downtilt 8.5 dBi omni
$ 50      - 802.11a 'backfire' antenna
$ 14      - U.FL pigtail
$ 70      - 802.11a radio
$320      - Metrix kit (with 200mW 802.11b radio)
$ 20      - misc fittings (copper, cat-5, hose clamps)
------
~$650 each radio

Sputnik based:

$ 20      - 1 x LMR-400 N-male N-male cables
$ 20      - lightning arrestor
$ 45      - PoE
$ 65      - downtilt 8.5 dBi omni
$290      - www.sputnik.com/products/aps/ap200.html
$ 20      - misc futtings
-----
~$460      - includes tax on sputnik

Netgate HS3000 based:

$ 20      - lightning arrestor
$ 65      - downtilt 8.5 dBi omni
$355      - www.netgate.com/product_info.php?products_id=41
----
~$440     - 250mW HS3000 comes with lots of odds/ends

Base Station Options

Sputnik 160 (WDS only)
~$110 - with tax and ship

M0n0wall based Nokia IP110

$100  - Nokia IP110 from Ebay ???
$ 20  - HD to CF adapter (mini-box)
----
$130  - with ship - very approx!

M0n0wall based Soekris:

$161  - net4501 with case
$  9  - power supply
$  10 - CF card
----
~$190 - includes tax

This started out being short but ended up pretty complete. Please ask any questions about anything that isn't clear.

If we can get the go ahead fairly quickly, we could schedule this installation quite soon. This will be a very worthwhile addition to this community as well as a great wireless learning experience for everyone, so I hope to see a few new faces on install day :-) .

Golden Villas Wireless Internet Installation Report

Golden Villa - computer lab before Golden Villa - computer lab after Our intrepid band of volunteers really pulled through today with the most complex single-day install we've ever accomplished!

For starters, there was the common room that become a computer lab. Then there was the dual node installation of a main AP and a second rooftop repeater AP. These were all driven by a newly installed router, firewall and captive portal box (a soekris box running m0n0wall). Many, many thanks to all of you, both the regulars and the newcomers. With one less person, it would have been hard to finish in one day.

Things that went well

Golden Villa - Main AP by moonlight (sort of) We've learnt a lot in the past year and are applying it more consistently. In particular, we've found that the more work we can do before getting onsite, the smoother the day will go. This allows more time to cope with the unexpected.

Some specific things we've learnt previously and applied well this time:

  • a solid site survey with the intended installation equipment, including antennas. This meant we didn't have to do any testing or relocation of gear on the day.
  • timely purchase and assembly of all the equipment -- physically assembling all the gear beforehand eliminates surprises like: missing small but critical components (zip ties, sealant goop) and catches problems like incompatible mounting hardware (though see below)
    Netgate HS 3000 box and mounting plate
  • network planning -- we designed and fully documented the network layout, including all equipment interface IP assignment, subnets etc. We've always done the design before, but never documented it so well (still room to improve)
  • preconfigure settings and end-to-end test, and document it -- this was probably the first hard learnt lesson and we've taken it to heart, though this was the first time we'd documented it. Each piece of gear was configured according to the network plan and documented as we went (gateway router, HS3000 AP). Then, and this is the crucial step, it was all hooked together and connected to a live internet feed. However even this wasn't a perfect test, see below.
    Golden Villa - feeding the ground wire down the spout
  • project planning -- Also for the first time we put together a planning document. This was the largest install by far that we've ever attempted in one day. We usually do one node, period. This was two nodes and a lab. So we decided to split out the tasks and divvy up responsibilities ahead of time. This allowed some of the work to be frontloaded before the day and also allowed tasks to proceed in parallel on the day. We have more work to do on this approach, but it was a promising start.
  • start early -- 10am was on the early side for an install day, but with the ambitious schedule we planned, it was a good move.
    Golden Villas - Grounding the rooftop gear
  • standard gear -- for a while we've tried to find a standard set of gear and stick to it. This simplifies ordering and stocking (e.g. we always use 48" LMR 400 N-male to N-male cables and hence N-connectors on all radios). Although we used new radios this time and a new relay approach (WDS), the rest of the install followed a familiar pattern: SBC m0n0wall based gateway/router, PoE powered rooftop gear, lightning protector and 8 gauge copper ground to a solid ground rod or equivalent, our usual Superpass omni downtilt antenna and small stuff like UV-rated zip ties, hose clamps for mounting, duct goop for waterproofing etc.
  • volunteers rule -- Last but not least, our many skilled volunteers made the day the great success it was. Given how we're structured and our educational emphasis, we often don't know until the day exactly who will turn up apart from the core team. However it never fails (so far!) that everyone who does show up brings some vital piece of gear or some special skill that makes a unique contribution to the day.

Golden Villa - Installing the main AP Many, many thanks to the volunteers who showed up on the day and who provided critical support beforehand, including: Seren, Drew, Jason, Michael, Dave, Dlan, Stewart, Marc, Joe, Ben, Matt and Mike S. Not to forget our president Lee, who also wrote a wonderful thank you. All your contributions were vital.

Things we learnt

Although all's well that ended well, there were some 'learning opportunities' during the day. The reason for mentioning them here is not to dwell on them, but rather to make note so we can avoid these problems in the future if possible.

  • always put all the gear together before getting on site - in this case the 1" mounting poles didn't fit securely in the 1" mounting brackets leading to a last minute scramble to find an appropriate mounting solution. Fortunately we've learnt this lesson already with the electronics, and all of that worked great, with no onsite configuration necessary.
    Golden Villas - Power for Repeater AP
  • Double check the configuration as applied - for the first time we completely documened the planned network IP layout, but the gateway WLAN IP was erroneously set to the base network address of 10.12.11.128 instead of the first IP value of 10.12.11.129. Strangely, this worked during testing and also for the laptops we tried which were running WinXP, but not for the lab computers rnning Win2k. (The symptom was DNS not working).
  • Plan on making an extra trip to Home Depot - the best laid plans oft go awry. Ideally a trip offsite to get odds and ends won't be necessary, but better to plan for one anyway and then be thankful if you don't need to go.

Equipment Used

Golden Villas - gateway router

Used forName & LinkApprox PriceQty
GatewaySoekris 4501$2061
8MB CF card, cables$151
RadiosHS3000$3202
Antennasdowntilt 8dBi$652
lightning protector$202
Cables1.5M N-Male N-Male$182
Masts1" aluminum offcuts$52
MiscMounting hardware, electrical hardware~$501
VolunteersPizza Lunch$501


a work in progress - the final tally is still being worked out