We have built many networks serving low-income communities. Below we describe one of our earliest projects located in one of the poorest zip codes in San Diego County. Follow the menu links to read about many more in great detail. (Note that the equipment and methods used have changed over time.)

On October 26, 2005, the Mercado wireless Internet officially opened to residents with a training evening, followed by resident installation help from Socalfreenet.org volunteers. An estimated 35 residents spent 2½ hours learning how to safely use the Internet and then took their adapters home to hook up their computers. This was the culmination of many months of effort by both Socalfreenet.org and the MAAC Project.
This project had many pioneering aspects. Among them were:
Well before the official launch of Mercado wireless Internet, residents had discovered it for themselves. Ten to fifteen computers were active on the network during the months of incremental deployment by Socalfreenet.org’s volunteers. Usage grew at a steady rate as more residents came online in advance of the official training and launch date and then spiked up and continued to climb in subsequent months.
In October of 2006, Socalfreenet.org began an upgrade of the network to eliminate some marginal areas of coverage. True to style, this was done using cutting edge technology, with the implementation of a new mesh network pioneered from MIT research and commercialized by Meraki Networks.
Usage has steadily increased since this upgrade, with 75% more users per day with a total of 40 computers per week using the network recently.
The upgrade also improved online management and tracking. Better online tools allow online visualization of users and current status. For example, the picture at left shows the twenty-five active radios (large balloons) while the smaller balloons show current local users.
Recently Socalfreenet.org began a regular ‘help the residents’ Saturday morning on the first day of each month. Local MAAC Project staff keep a list of people who need help and work together with Socalfreenet.org to resolve any issues and provide training as needed.
This innovative parnership between Socalfreenet.org and the MAAC Project in the Mercado has provided affordable high speed internet access to all residents. The climbing adoption rate shows the value residents are finding and is a tribute to the efforts of everyone involved.
Barrio Logan is a community near downtown San Diego.
Node 1 Install Report
Node 2 Install REport
Node 2 revisited
Today volunteers from SoCalFreeNet got together and installed two new nodes at the Mercado Apartment complex. It was also a great training day, with three volunteers lending a hand for the first time. Many thanks to Ben, David, Doug, Drew, Jason, Marc and Pascal for providing their valuable time and expertise!
These two nodes are also a change for us. We had originally planned to simply repeat our node 1 and node 2 installations, but with new equipment coming onto the market all the time, and new software updates becoming available, we decided to try something new. Plus, we like experimenting! Go directly to the photos, or keep reading.
The result so far is very promising. Instead of spending an hour or more configuring pebble via ssh, and then repeating the installation for the second radio, we used the latest release of M0n0wall which now supports Atheros based radios, and hence the 802.11a component of our relay. Initial configuration took about 15 minutes and the second node took less than 5 as we could simply copy the single config file from one node to the other and adjust a couple of settings (wan static IP, WLAN subnet and DHCP range).
We're also using new hardware. WRAP boards have been around for a while, but we've used Soekris more often because of better availability and familiarity. However they are gaining increasing popularity with WISPs and we also obtained one and wrote about it in our recent book, so we were eager to try one. We've recently used Metrix kits instead of building our boxes because they're more convenient, well packaged and well priced. However the arrival of WRAP outdoor cases by Mini-box (see also our recent review) presents an alternative attractive solution. The bundle by Netgate is a convenient way to purchase this, except for the RP-N pigtails and 5 dBi antennas which we didn't use.
The topology of our network is a central 802.11a access point that is connected to the internet. From there we have several 'relay nodes' which receive the 802.11a signal and then supply internet via an 802.11b AP. The buildings at this particular site have walls that kill the 2.4GHz signal very quickly, so we need to have multiple access points even though the actual site size is relatively small. Click the map at right to see the node locations more clearly.
Each node runs in its own subnet and provides DHCP and DNS caching for local 802.11b clients. NAT (aka masq) is not done at the node location, but rather at the central gateway. Avoiding NAT at the node level will allow possibly future applications within the site, plus it allows the main gateway router to provide captive portal services for the entire network and generally centralizes management tasks. Read the network configuration for specifics.
The installation went smoothly. We started the day by reviewing and explaining the equipment in use and then stepping through the m0n0wall configuration we had used. All the equipment had been pre-assembled, mounted on the mast and tested first off-site and then onsite to help ensure that the day would go well.
Next we unpacked tools and lugged the gear over to the proposed location for node 3. Choosing the actual rooftop is a tradeoff between potential future growth of foilage, ease of access to the ground level utility cabinets where the power is and the coverage goals. And, to keep things interesting, it often isn't apparent until you actually get onto the rooftop whether or not a location will be suitable. E.g. for the second installation (node 4) we chose a rooftop from the ground, but then had to switch to an adjacent roof when we discovered intervening palm trees.
At this point we split into ground and rooftop teams. The roof team further split. Marc and Jason concentrated on mounting the radio. Pascal measured, cut and threaded the cat-5 cable and ground wire into conduit and fed it to ground level via the drainpipe.
The ground team took the drop from the drainpipe and routed it around to the utility closet using the flashing at the bottom of the buidling wall which had conveniently located holes for zip ties. The cat-5 cable went inside the utility cabinet to pick up the PoE power and the ground wire continued in the dirt to around to the large water pipe disappearing into the ground.
Click to view the photos below and the associated text with more information.
We haven't completed tallying up yet, but the approximate per node cost is $650. This breaks down as:
| Cost | Item | Comment |
|---|---|---|
| $399 | Netgate PowerG8 dual radio | or this plus this for $35 less (go figure?) |
| $28 | 2 x u.fl N-female pigtails | |
| $36 | 2 x N-Male to N-Male cables | |
| $45 | 802.11a panel | or a (better?) $40 dish |
| $20 | lightning protector | |
| $70 | downtilt 802.11b 8dBi omni | or $40 for no downtilt |
| $20 | mast and mount | |
| $30 | outdoor cat 5 + ground wire + fittings | |
| $20 | fudge factor | |
Overall, a pretty reasonable price. Just a year ago, this same functionalit cost almost $1000. And quite likely it will be closer to $600 before too long.
Here is the current status of the Mercado network.
On Friday, March 3rd starting at 10am, we will be installing the 3rd and 4th nodes at the Mercado Apartments (directions) in Barrio Logan. On previous project days, we have installed an 802.11a AP on the rooftop of the manager's office and also an 802.11a bridge/802.11b AP on the farthest building.
For more details on previous installs, see: main AP, node 1 and node 2 installation reports.
The function of Node #3 and Node #4 will be to extend the wireless cloud inside the Mercado apartment complex. The addition of these two nodes should largely complete the installation. Further testing will follow to determine if another node is required.
We'll be adding nodes 3 and 4 as described in the network configuration.
We will install Netgate WRAP based hardware. This device uses an Atheros a/b/g radio which we will use (in 802.11a mode) for the backhaul, as well as an 802.11b Intersil Prism 2.5 radio which we will use for client access.
For software, we will be using the latest M0n0wall release, beta version (1.2b6) which now supports the Atheros chipset. This will be our first attempt to use M0n0wall in a relay/bridge mode and we are very excited about its potential use in this capacity for future deployments.
We have 2 nodes to install, therefore we will need two teams to perform identical tasks. First, we will be attaching all of the devices to the antenna mast and mounting the mast to the rooftop. Next, we will run cat5 down the side of the building to a PoE injector located in the utility closet. Next, we will install a lightning arrestor and run grounding cable. If we cannot find a suitable grounding point, then we will install a grounding rod. Finally, we will perform QA/Safety/Regulatory Compliance checklists to ensure a proper deployment.
Day of Install Tasks:
Volunteer 1 (Team 1: Michael, Team 2: ?)
- Prepare mast assembly (attach antenna / lightning arrestor / waterproof putty)
- Install mast and secure to building with mounting bracket
Volunteer 2 (Team 1: ?, Team 2: ?)
- Run grounding wire, find (or build) appropriate grounding point
- Run Cat5 along roofline
- Crimp Cat5 heads (terminate cables w/RJ45 jacks)
Volunteer 3 (One Volunteer for both Teams: ?)
- Perform QA / Safety checks, complete checklist
Folks who've volunteered so far: Neven, Eric, Jason, Doug (EC: see private pages for full contact info)
Budget:
- Insert costs here
Today some SoCalFreeNet volunteers went to the Mercado site in Barrio Logan. We've been there several times before at the request of the MAAC project to explore providing free wireless internet access to their residents and the surrounding community.
Today, our goal was to get some actual real-world equipment onto a rooftop, and ideally leave with one building online. We planned to do this by:
We managed to achieve our first goal, despite a few obstacles along the way (e.g. it initially looked like we wouldn't be able to get power to the rooftop). And, best of all, we discovered that, unlike easlier site surveys, it seems that we might be able to cover four buildings per AP, instead of the 1-2 buildings we'd estimated. We'll know for sure after we've had a chance to get inside and/or get some residents online.
We're going to go back tomorrow to finish goals 2 and 3. We did make good progress on 3, as it appears we can pull the signal off an existing 802.11b wireless AP in the office using one of our standard client kits.
We have a multi-node wireless network installed in a 144 apartment complex with 24 buildings. The one router that binds and rules them all is currently running m0n0wall. This article describes the configuration of the network as a whole and m0n0wall specficially. There were a number of gotchas involved in setting this up, so I lay them out here here in the hope it will save others some time.
Each node in the network resides in its own /27 subnet (full addresss details) and has its own dhcp server and DNS cache. All nodes route to one master node in a classic "star" point to multi-point configuration.
The master node in turn connects to the gateway node which is connected to a DSL modem using PPPoE for its connection. The gateway node also provides DHCP and NAT services to local office computers and a computer lab.
The gateway router has to provide the following services:
In addition the following features are nice to have:
M0n0wall provides the capabilities to do all this (and more).
to be continued - a work in progress
Golden Hill is a recovering neighborhood overlooking downtown San Deigo. In 2002, Socalfreenet.org installed wireless Internet for a local landlord who wished to help the community. That network has grown to over 20 locations covering a 20 block area and is used by hundreds of people every day.
The map below shows the network locations for the Meraki portion of our network:
Today (2/14/04) the SDWUG/SoCal FreeNet crew met up at Influx in Golden Hill for our monthly install day where Golden Hill residents are welcome to come to Influx and ask questions and get advice and even have members come to their houses to help them get online.
Today was interesting, as we also had a scheduled site survey for possible expansion of the Golden Hill network to the rooftop of a house at the intersection of 26th and Broadway. Myself, Drew, and Steven broke from the influx group to scope out the situation. Structurally, the house is just begging to have some antenna masts, LMR, and CAT-5 run all over the place! There is even a small, unused room at the back of the house that could house some gear, and an attic/crawl space to run CAT-5. The roof has several places that would make great mounting positions for a varitey of antennas. The owner (Jay) has already given us an indication that he would be willing to put a tall mast and a parabolic grid antenna as well as an omni on the roof. (click "read more" for the rest of the story)
We didn't get as much time as we would have liked, as the rain started coming down about 15 min after we got there, but we had enough time to set up a tripod with a 16 dBi yagi. Drew braved the steep roof pitch and set up the tripod and we ran a length of LMR400 down to my laptop. Long story short, it looks like this expansion is very possible!
The very first location for SocalFreeNet was in Golden Hill, San Diego. In fact the success and fun of that project, inspired the creation of SocalFreeNet! We currently have six locations there.
You can find some history at the GoldenHillFreeWeb website (not currently maintained):
www.goldenhillfreeweb.org

El Toyon is a rec center operated by the city of National City. It serves low income neighborhoods with diverse populations. In addition to being a community meeting and focal point, the rec center also offers after school programs attended by 50-60 children on a daily basis. Activities include board games, organized sports and ceramics classes.
The source of funding for this project was a donation from a generous and civic minded local resident who lives 5 blocks away from the rec center. The project sponsor has offered to pay for all hardware expenses in addition to the monthly ISP fees. h3. Address The location is El Toyon Rec Center: 2005 E. 4th Street National City.
On March 26, 2005, Socalfreenet volunteers completed the installation on Saturday with a large turnout from the local community. Local council members also came by to help, and the installation was featured on the local TV news and in the Union Tribune. The Tribune reported:
On Monday, which was the beginning of spring break, many of the kids at the center were surprised when they saw the new computers. Up to 90 kids a day visit the center.
"They're really excited," said recreation leader Katrina Baca. "A lot of them don't have access to computers or the Internet. They don't want to get off."
El Toyon is a rec center operated by the city of National City. It serves low income neighborhoods with diverse populations. In addition to being a community meeting and focal point, the rec center also offers after school programs attended by 50-60 children on a daily basis. Activities include board games, organized sports and ceramics classes.
The facility itself was build in 1962 and appears to contain pourous and very RF friendly building materials. During our site survey, only 2 APs were discovered (SSID = natwireless, channel 6, WEP on).
The rec center facility itself is a series of medium sized "conference rooms", attached to each other to form a U shape. All building are single story with angled pitch rooflines. A telephone jack exists in the administration office (adjacent to the ceramics room).
The source of funding for this project is a donation from a generous and civic minded local resident who lives 5 blocks away from the rec center. The project sponsor has offered to pay for all hardware expenses in addition to the monthly ISP fees.
The location is El Toyon Rec Center:
2005 E. 4th Street
National City
We propose deploying a Soekris Net4511 to provide wireless coverage to the surrounding neighborhood. This device would run the M0n0wall FreeBSD based operating system. The advantage of the net4501 is that it supports a PCMCIA card (allowing us to install a 200mw Senao radio) in addition to a mini-PCI slot, which we could leave unoccupied and available for future 802.11a expansion. Unlike the Netgate G8 WRAP-based alternatives, the Soekris net4511 contains 2 ethernet ports.
We intend to assign one port for the WAN. We have selected DSL Extreme as the ISP, as they allow sharing in their ToS. The other port will be configured as a LAN port (in a segment protected and firewalled from the WLAN segment). The LAN port of the Soekris device will be connected to a 24-port switch, which will then be connected to the lab PCs.
M0n0wall offers standard functionality we intend to enable, including captive portal, bandwidth shaping, SNMP monitoring and more.
Here are the steps taken to program monowall for use at El Toyon Rec Center with a Soekris 4511 box. Read the Network Configuration in conjunction with this guide.
Download M0n0wall, install on 16MB CF Card.
Connect Ethernet to eth0 (PoE). By default, M0n0wall will be running DHCP on that interface and give your laptop an IP address of 192.168.1.199/24, with a default gateway of 192.168.1.1. Open a browser and point it to 192.168.1.1. Default username/password = admin/mono.
The latest version of m0n0wall available was used, 1.2b6. It was configured as follows.
Query: It would also be possible to bridge the wireless and LAN interfaces and just use one /24 subnet instead of two separate ones. This may be a preferable configuration. It also has the advantage of forcing the captive portal on the lab computers also - which would otherwise avoid the captive portal because it can only be active on one interface
That's the important settings completed. Everything should basically work at this point and its worth stopping to make sure. Click Reboot.
After rebooting, you'll need to release and renew your IP address. Assuming you are on a wired interface, M0n0wall should assign an IP address of 10.12.10.99/25, with a default gateway of 10.12.10.1. Open a browser and point it to https://10.12.10.1. (Don't forget the S in httpS://10.12.10.1).
We want to keep the LAN completely firewalled from the WLAN so we need some rules to ensure that it is:
Unfortunately now we can't access the browser-based administration interface via wireless on the WLAN, so we add another rule. We make this rule very specific:
At this point it shold now be possible to access https://10.12.10.1 from a client on the WLAN port (i.e. a wireless client).
Some additional settings will complete the configuration:
That's it! Save the configuration just to be safe (under Diagnostices -> Backup/Restore).
Further configuration can be done for syslog, outside PPTP access etc. This will be added here as time permits.
Network configuration: El Toyon network IP layout and m0n0wall config
Cabling: We will install 2 cables- one from the DSL modem to the Soekris, the other from the lab switch to the Soekris.
Given that the RJ11 telephone jack terminates in the manager's office, we will place the DSL modem adjacent to the telephone jack. Near the DSL modem, we will drill a hold to penetrate to the outside wall (on the side connected to the interior of the courtyard). In addition, we will drill a hole between the manager's room and the ceramics room, which share a common wall.
![]()
One Cat5 cable will be fed from the switch in the ceramics room, through the hole to the manager's office, then through the hole to the courtyard, elevated to the roofline and laid out along the edge of the eve along the length of the building to the location of the Soekris mounted in the outdoor box (LAN port).
The second cable (running alongside the 1st cable) will run from the DSL modem to the WAN port of the Soekris and be injected with power at the DSL modem side in the manager's office.
![]()
The Soekris will be mounted on one of the primary roof beams of the southwestern most building, as close as possible to the telescoping mast. (This appears to be the highest point). The mast (appx. 25-30 feet tall) will extend from the ground to the roof line, where it will be attached to a supporting beam using a metal bracket. The mast will extend above the roofline by 5-8 feet (as permissible by safety considerations). The omni antenna will be attached to the top of the pole using a hose-clamp or other secure mechanism.
The lightning arrestor will be grounded using grounding wire attached to an 8 foot metal grounding rod, or adjacent grounding point as determined to be safe, effective and building code compliant by Marc Palumbo, QA/Safety/Regulatory Compliance Manager.
- 10 PCs with monitors, mice & keyboards will be assembled in the ceramics room, across folding tables along the length of the wall, opposite the door. All PCs will be connected via custom length Cat5 cables to the switch.
Project Manager: Lee
Volunteer 1 (Lee)
- Install & test DSL modem using laptop
- Install M0n0wall and test config prior to install day
- Verify M0n0wall configuration on install day
- Assist others
Volunteer 2 (Drew &Marc)
- Prepare mast assembly (attach antenna / lightning arrestor / waterproof putty)
- Prepare bracket for roof truss and antenna mount.
- Drive 8 foot ground rod for antenna base support and ground.
- Install mast and secure to building with mounting bracket
- Mount Soekris / outdoor enclosure to beam / under roof
- Run grounding wire, find (or build) appropriate grounding point
Volunteer 3 (Marc & Mick Laver)
- Run Cat5 along roofline
- Crimp Cat5 heads (terminate cables w/RJ45 jacks)
- Build custom length cables for lab
- Perform QA / Safety checks, complete checklist
Volunteer 4 (Mick Laver)
- Drill Holes in wall - manager's office to lab, manager's office to courtyard
Volunteer 5 (?)
- Perform QA/Safety/Regulatory Compliance testing and complete checklist
Volunteer 6 & 7 & 8 (Wayne & Bao Nguyen & ?)
- Physically set up PCs
- Determine Ethernet cable length requirements
- Attach cables for keyboard, mouse, video, Ethernet
- Configure & verify networking
Volunteer 9 (?)
- Walk around the neighborhood and determine wireless coverage area
Schedule
9:30AM - 10AM Educational session on how to set up and configure M0n0wall
10AM - Begin Install
| Purpose | Price | Product | Status |
|---|---|---|---|
| Access Point | 166 | Soekris 4511 | mikemee |
| 60 | Senao PCMCIA | mikemee | |
| 11 | MMCX to N-female bulkhead pigtail | mikemee | |
| 20 | PoE adapter | mikemee | |
| 13 | electric box case | mikemee | |
| CF card 8MB or greater | donated by Lee | ||
| RF gear | 30 | 15 dBi antenna | marc |
| 24.31 | 10' LMR400 N-Male - N-Male | ordered from WLANParts.com by Lee | |
| 20 | lightning protector | mikemee | |
| mounting | 50 | 30 foot telescoping antenna mast & fittings | Marc |
| Misc | 35 | cat-5, ground wire, fittings, rod | mikemee |
| 50 | lunch for volunteers | ||
| Security | 70 | IP Camera | need to order |
| Lab | 24 port switch | donated by Steve | |
Most prices reflect tax and shipping. "Need to order" prices may not.
The El Toyon Rec Center was an extremely successful install day!
We all met at 9:30AM and proceeded through a M0n0wall installation lesson. We reviewed every detail of how to install M0n0wall and repeated all the steps to configure M0n0wall as performed for the El Toyon installation.
After the M0n0wall lesson, we walked through the procedures to be performed during that day's activities. We immediately noticed an issue with the Manager's office- the telephone line was on a wall that had no available AC power. (The closest power outlet was on the other side of the room). As a result of this discovery, we modified the plans slightly. We drilled a hole between the Manager's office and the lab room (formerly the Ceramics room), and ran the RJ11 cable between the two rooms and mounted the DSL modem inside the lab. This change had the added advantage of not requiring physical access to the manager's office for future troubleshooting.
Volunteers then set up the physical PCs on the desks along the wall. They were oriented such that the monitors were facing the main entry door and a computer user would have their back to the main door. In this arrangement, the computer users could always be monitored. After a few minutes, we discovered that the tables could not support the weight of the computers (they were bowing in the middle), therefore we replaced the tables with stronger tables. Custom length Cat5 cables were made between each PC and the switch. Several members had the opportunity to learn how to make Cat5 cables.
Next, two long lengths of Cat5 cable were run. One cable ran between the Soekris board and the switch ("LAN"). The other cable ran between the Soekris board and the DSL modem ("WAN"). Great care was taken by SoCalFreeNet members to tack the cable to the ceiling and roof eve very carefully and in an aesthetically pleasing manner.
To mount the antenna mast, a sheet of hardened aluminum was cut to size. The reason for adding the aluminum brace was to provide a mounting surface for the antenna mast (pole) that extended more then 3 inches away from the roof (per Marc, this is a requirement to be compliant with building codes). The antenna was then mounted to the pole. Also, the Outdoor box was mounted to the side of a beam. This was a clever solution which provided protection from the elements. In order for the mount to work, we needed to remove the Soekris board from the case, mount the case to the beam, then reinstall the Soekris board into the case. This was an extra step, but resulted in a more solid and secure installation.
The mast was then hammered from above to drive it a few feet into the ground. An additional 8 foot grounding rod was installed next to the mast. The lightning arrestor was installed and connected to the pole, which was, in turn connected to the grounding rod at its base.
We powered everything up, and amazingly (on the first try) it all operated perfectly. The surrounding neighborhood is now covered by free wireless Internet access. We will be working with SoCalFreeNet member and project sponsor Wayne in order establish a regular "Help the Neighbors Get Online" day.
The most amazing part of this installation was the enormous volunteer response that we received. Around a dozen SoCalFreeNet members showed up on their Saturday to make this deployment a great success!! Thank you again to all who volunteered!!!
On Sunday, January 30th, SoCalFreeNet.org volunteers Matt, Drew, Serin and Lee met at the residence of SoCalFreeNet.org member Steve in Normal Heights (near Mansfield St and Collier Ave)to deploy the newest SoCalFreeNet node! Thanks to the great preparation work by Steve and Michael, the install was a slam dunk. After only 2 hours of climbing ladders and playing with power tools, we were live! Steve has a Business Class Cox Cable connection (which allows legal sharing). A dslreports.com speed test revealed a 1.6Mbps downstream and 200k upstream connection.
From the cable modem, a Cat 5 cable runs to a 1U rack mounted server running M0n0wall. From there, a Cat 5 cable runs 2 stories up to the attic, where a Cisco 1200 is mounted on the ceiling. One small omni antenna serves the residence, while the other antenna port connects to a 50 foot LMR400 RF Cable run connected to a Superpass 8.5 dbi antenna (w/10 degree downtilt) mounted on the side of the roof.
We utilized two Y brackets to secure the mounting pole to the side of the roof, and then two hose clamps to attach the antenna to the mounting pole. We used a continuity tester to discover that the metal shroud (HVAC housing) was connected to house ground, so we used a short segment of 8 gauge solid copper grounding wire to connect the lightning arrestor ground port to the metal shroud.
Free wireless Internet access for Normal Heights courtesy of Steve and the SoCalFreeNet volunteer crew!
As Steve already owned the 1U server and Cisco 1200, the only costs for the deployment are listed below (Thanks again Steve for sponsoring this node!!!)
$65 - Antenna: Superpass SPDG60-D10
$20 - lightning arrestor
$12 - 2 Y mounts, Home Depot, $6 each
$ 6 - pole used as antenna mast, purchased at Fry's
$ 5 - ground wire, zip ties, misc stuff
===
$108
More images from the day:
Sherman Heights (zip 92102) is our 2nd neighborhood and third access point location - and the first officially built by SocalFreeNet.
Installation of the hardware was recently completed. Feb 11 update: Software configuration is complete and the node is fully operational.
A group of 3 SDWUG members met at 10am to start the installation. Based on our previous site survey we planned to install our shiny new standard access point in a relay configuration. I.e. two radios, one to pick up service from our existing (premier!) Golden Hill node, and another to rebroadcast it. Note that we use separate radios due to the potential interference issues found by the NoCat and as discussed elsewhere.
This install was a little premature in that we still had software issues to resolve and were waiting on a replacement radio via Saturday delivery that hadn't arrived yet, but it was otherwise good timing for the building owner whose electrician was going to be around. So with a lot of last minute scurrying around for odds and ends, we optimistically gathered to see how far we could get. Fortunately physical access didn't involve ladder climbs like previous installs!
Physical installation went well but quickly stalled when our relay radio couldn't connect to the Smartbridge AirpointPro about 5/8 mile away but could connect to the other radio we were installing. We were perhaps a little sidetracked by this, as we'd previously had a problem with a Smartbridge in bridging mode to a Cisco 350 AP. After Lee (longtime SDWUG member and general wireless guru) arrived he quickly led us down the right path.
He suggested we start eliminating other variables in the chain: antenna, cable, radio card. This is where having two of everything onsite is a real lifesaver! We knew the antenna and its orientation were good as we'd aligned it using signal strength readings from Netstumbler. We swapped cables with no difference. Finally we deduced that the radio card was getting close APs but not further ones. Putting the case lid on/off and re-orientating it confirmed this.
As we'd by now fetched the (two!) Saturday Fedex and UPS deliveries of miniPCI radio cards (from Netgate.com and wisp-router.com, rather than mess with the radio and the delicate U.FL connector, we installed one of the new radios and reconnected it - hoping to eliminate either the pigtail or radio this way. It worked! Finally, about 3 hours into the install, our relay radio could connect to the base station!
The AP radio and antenna install was a breeze by comparison. With m0n0wall trivially setup to bridge the eth0 LAN port to the wi0 wireless card, it was soon providing reliable (albiet slow) access from Lee's laptop.
The next job was to string CAT5 from each radio back to a common point where we could provide power using our home-brew POE adapters and link the two radios via a crossover cable. We didn't have the proper mounting clips and had to make do with bent over nails. We're have to go back and finish that, along with hooking up the lightning protectors to a good ground.
The next task was to get the software configured. We'd pre-configured m0n0wall for the relay radio to provide dhcp, firewall and routing services (with NAT disabled of course) rather than a pure bridge. Unlike our other two APs in the area which are pure bridges, we'd like to start subnetting and reap the management benefits including easier stats collection, ability to change routing as other APs come online etc.
We succeeded in getting outgoing connections, but not for more than one user at a time. Our internet access is provided through another Soekris running
MikroTik's RouterOS which provides captive portal and bandwidth management (eventually we hope our project to add captive portal to m0n0wall replaces this). Each successive user cut off the previous user. Our current thinking is that there is some setting in the captive portal that needs to be adjusted for this.
As laptop batteries started draining and families started calling, we packed up. The node is operating, sort of, but much fine tuning remains!
We knew this one going in, but its hard to stress the importance of verifying and validating all equipment under real conditions before trying to install it. E.g., the relay radio associated fine in all tests prior - but in hindsight we were always within a few metres of the AP with the metal lid off!
The physical design of the AP isn't perfect. E.g. we put the bulkhead female N connector in a place where its easy to damage when mounting the box. Its also a much deeper box than needed. Otherwise though, we're happy with the enclosure for this climate (and especially the $14 price!).
Physical proximity is no substitute for a good site survey. Our link relay quality is so far a little disappointing. A 'netgear' AP is a about 30 degrees away on the same channel as our distant 'base' AP. This plus perhaps the two trees between us and the cheesy 5 dBi omni at the base AP (another long story), combine to make the signal strength and quality vary between -38-60dBm and 50-90% respectively. Time will tell how effective this is (plus we can likely tune the antenna pointing a little more).
Overall this was a very smooth install. We had all the parts we needed (except U-clips for the cat5 cable), good diagnostic tools and we left at the end of the day with a $1000 hanging off the walls and a (mostly) working system. Several things we did helped this happen.
Two of everything. One nice, mostly unforeseen, result of deciding to separate radios is that we had two of almost everything. This makes it really easy to swap pieces back and forth to eliminate problems.
M0n0wall is a great software choice. Its small (<8MB), fast, reliable and, most of all, easy to configure. The GUI is a snap. Everything is saved in a single XML file. We were able to rewrite the flash a couple of times to get to a known working default and then either reload the config file or just tweak via the web interface.
Our standard AP project looks good so far, though more expensive than we'd like. E.g., our AP is essentially a $300 dumb bridge. We might be able to better than this in the future - at the expense of having two of everything, bummer.
A big thanks to the building owner who made this node possible. Without his excellent location (did you see that view?) and funds (assuming he pays the bill :->), this node wouldn't have been possible.
And of course, many thanks to the SDWUG folks who made this possible and so enjoyable! Especially master welder Matt, and master debuggers Lee and Chris.

Golden Villas is an affordable housing location in South Park, San Diego. it has 44 dwellings in 11 buildings, and a community room. A local non-profit manages the housing. The residents are a broad demographic and are mostly families with children.
In Feb 2005, Socalfreenet volunteers descended en masse and installed two rooftop access points, a gateway sharing and firewall device in the office to provide wireless coverage for the entire complex.
At the same time, they also completely cleared out the disused community room and installed a complete computer lab with six computers donated by the San Diego Futures foundation.
This has been a flagship installation. Most of the residents here use the internet, as well as many surrounding houses. The system has been incredibly stable, with outages measured in minutes per year.
Note: This document was a 'living' document during the planning phase, and as such was never quite up to date. And so far it has not been updated to reflect the final outcome on the installation day. However we're leaving it here in this state to serve as a guide for the next install and/or interested readers. Please don't mistake it as "The whole truth and nothing but the truth.".
This document is a central planning document for the Golden Villa installation day. The address is
http://maps.google.com/maps?q=3385%20Elm%20St%2C%20san%20diego%2C%20ca and the start time is 10am.
The installation has four parts:
Below are the details for each part of the installation.
The main AP will be located on the peak of the roof which contains the office. The AP will be mounted directly on the wall and the antenna will be in a short pole screwed directly onto the roof peak. A supplied Cat-5 cable will run down the roof and through a new hole into the office where it will be connected to a router which will split the cable internet between the office network and wireless network.
The network configuration is detailed here and there is a separate step by step covering the m0n0wall configuration and Netgate HS3000 AP configuration.
The following equipment has been purchased for the installation:
Netgate HS3000 which includes a 50 ft outdoor cat-5 cable
SuperPass 8dBi 10 degree downtilt omni
Hyperlinktech Lightning Protector
Soekris 4501 in case with m0n0wall
Purchase a drill bit to put the cable through the office wall
Purchase sealant to fill the hole after we put the cable through
Solve the problem of extending the ethernet cable if necessary.
Configure the MikroTik
Configure the AP
The second wireless AP will be mounted at the other end of the complex. It will operate in repeater mode.
The following equipment has been purchased for the installation:
We will receive 6 computers running fresh installations of either Win2k or WinXP, complete with keyboard, mouse and monitors. They need to be hooked together into a switch with a D-Link kit which will get the signal from the main AP.
The following equipment has been purchased for the installation:
D-Link Bridge Kit to hook up the lab to the network
Cat-5 cables
Need an 8 port hub
Need a few power strips
Pick up the donated computers
The following equipment has been purchased for the installation:
Eight D-Link Kits - already programmed for socalfreenet.org (thanks John Kim!)
Ground lug
"U" clamps and matching wood screww
Radiator clamps
Here is a brief description of how we configured the two Netgate HS3000 250mW APs we're using at Golden Villas.
Setup is very much like configuring any AP, but with one twist - adding the WDS (Wireless Distribution System) setup. The basic steps are:
At this point we stopped to check that everything was working ok via wireless. Note that the AP resets between almost any setting change, so there is a pause and lost connection during this period.
Next we configured the LAN settings to match the network design, as follows:
At this point, of course, you need to switch the computer IP used. We actually plugged into the previously configured m0n0wall box and connected wirelessly. The m0n0wall gave us an IP and after going through the captive portal we could surf the net as hoped.
The last step was to turn on WDS support. The HS3000 requires that both "master" and "repeater" be set to point to each other. A convenient way to get the required MAC addresses is to use the Wireless Site Survey link, assuming both radios are on. Of course there are also stickers on the metal case and on the box they came in.
Now you're ready to test. This turned out to be a little tricky. Most client software doesn't give you any control over which AP you connect to and may even ping-pong between APs. So not only is hard to force the client to use a particular AP (e.g. the repeater instead of the master), most software won't even tell you the MAC address of the AP you're connected with. Before we worked out the test technique below we saw a lot of strange behaviour. Very slow links, dropped packets etc.
Skipping to what worked, we turned on the master AP but left the antenna disconnected (key step!). A few feet away we put the 2nd 'repeater' AP with its 8dBi omni connected. Then we took a laptop a few rooms away - i.e. far enough for the master to be too weak, but a good signal from the repeater was available. (This proved much better than our first approach of leaving both antennas on and taking the repeater AP a few rooms away.
It was interesting to start a ping to both radios and watch the results. From two separate pings to 10.12.11.130 and 10.12.11.131 the ping time for the connected radio was 1-2ms and double that for the other. As we walked away with the laptop and the client software switched from the master AP to the repeater, the pings first started timing out and then the times reversed with the shorter time for the repeater.
After the above we were satisfied that we had the network ready to install. Phew!
Here are the steps taken to program monowall for use at Golden Villas apartments with a Soekris 4501 box. Read the Network Configuration in conjunction with this guide.
The latest version of m0n0wall available was used, 1.2b3. It was configured as follows.
That's the important settings completed. Everything should basically work at this point and its worth stopping to make sure.
We want to keep the LAN completely firewalled from the WLAN so we need some rules to ensure that it is:
Unfortunately now we can't admin the firewall via wireless on the WLAN, so we add another rule. We make this rule very specific:
At this point it shold now be possible to access https://10.12.11.1 from a client on the WLAN port (i.e. a wireless client once WLAN is connected to an AP).
Some more settings will complete the configuration:
That's it! Save the configuration just to be safe (under Diagnostices -> Backup/Restore).
Drew, Seren, Jason and Michael did a site survey today at Golden Villa affordable housing apartments. Here's the report.
Two access points mounted at each end of the L shaped layout should be sufficient to provide adequate coverage throughout the complex. The buildings are 2 story with 4 units per building and attenuate the signal markedly. However the proposed AP layout allows most units in the buildings to receive a direct signal.
For equipment, we could either go our usual route and have a main AP with both 802.11a and 802.11b radios and a second AP relaying from there. Total cost approx $1300.
Alternatively, we could use a WDS-based solution either based on an inside AP-160 and two Sputnik AP 200 or the Netgate HS3000 (both about $900).
In addition, in the main office we'd either place an embedded PC running m0n0wall or a Sputnik 160 is possible if we go the WDS route.
In short, we could build a system for all 44 occupants and the computer lab for $1000 - $1500.
We saw 4-5 APs during out site survey - much fewer than normal.
The buildings form a rough L shape, with the office located on the leg of the L but towards the corner. It is wrapped around a road on the inside of the L with a gorge on the outside all around. Single dwelling houses are on the opposite side of the road.
The office has an existing Cox business cable connection and is the rooftop we used to place the test equipment (there are also 4 apartments in the building). The test AP was a 200mW Senao CB3 plus, http://www.wlanparts.com/product/NL2611CB3PLUS, with an 8.5 dBi 10 degree downtilt antenna, http://www.superpass.com/SPDG6O-D10.html. Right opposite the office is a community building where they plan to create a small computer lab.
With three laptops containing various combinations of built-in (Centrino) and external cards (30mW Atheros-based Netgear and 50mw? D-Link non-prism) we walked around all the buildings while running a continuous 1500 byte ping to the AP. When the pings started dropping we marked that as the edge of useful range.
Using this criteria, we determined that over half the buildings could be covered with one AP. Two remaining buildings had incomplete coverage. Some of those apartments could get good coverage from their front windows, but not beyond. Assuming the same propagation, we concluded that another AP mounted on the last roof of the tip of the L, but closer to the L corner would provide the whole complex with good coverage. The houses across the road on the inside of the L would also get good coverage, and likely the houses across the gorge (though there weren't many, and the downtilt makes it less likely).
None of the rooftops are flat. We decided that mounting a standard L shaped bracket like that used for satellite dishes on the end of the building at the peak of the roof would be simple and effective and allow the antenna to rise about 1 foot above the roofline. We could route outdoor Cat-5 cable to the roof via the water downpipes which are open at the bottom and then up to the box following side roof trim panels. A tall ladder will be needed for the installation day.
At the office location we will need to drill through the office walls like cable TV installers do. Inside will be power and the internet feed.
At the other building location the power box has a double outlet underneath the main meter box (5 meters - 4 units plus 'house'). We would need to add a water-resistant housing for the PoE. A simple 4x4x4 electrical box would suffice and could be mounted directly on the wall (perhaps even surrounding the double outlet box?).
Dirt surrounds all buildings so driving a grounding rod for lightning protection should be straight forward.
Standard relay:
$ 40 - 2 x LMR-400 N-male N-male cables $ 20 - lightning arrestor $ 45 - PoE $ 65 - downtilt 8.5 dBi omni $ 50 - 802.11a 'backfire' antenna $ 14 - U.FL pigtail $ 70 - 802.11a radio $320 - Metrix kit (with 200mW 802.11b radio) $ 20 - misc fittings (copper, cat-5, hose clamps) ------ ~$650 each radio
Sputnik based:
$ 20 - 1 x LMR-400 N-male N-male cables $ 20 - lightning arrestor $ 45 - PoE $ 65 - downtilt 8.5 dBi omni $290 - www.sputnik.com/products/aps/ap200.html $ 20 - misc futtings ----- ~$460 - includes tax on sputnik
Netgate HS3000 based:
$ 20 - lightning arrestor $ 65 - downtilt 8.5 dBi omni $355 - www.netgate.com/product_info.php?products_id=41 ---- ~$440 - 250mW HS3000 comes with lots of odds/ends
Sputnik 160 (WDS only)
~$110 - with tax and ship
M0n0wall based Nokia IP110
$100 - Nokia IP110 from Ebay ??? $ 20 - HD to CF adapter (mini-box) ---- $130 - with ship - very approx!
M0n0wall based Soekris:
$161 - net4501 with case $ 9 - power supply $ 10 - CF card ---- ~$190 - includes tax
This started out being short but ended up pretty complete. Please ask any questions about anything that isn't clear.
If we can get the go ahead fairly quickly, we could schedule this installation quite soon. This will be a very worthwhile addition to this community as well as a great wireless learning experience for everyone, so I hope to see a few new faces on install day :-) .
Our intrepid band of volunteers really pulled through today with the most complex single-day install we've ever accomplished!
For starters, there was the common room that become a computer lab. Then there was the dual node installation of a main AP and a second rooftop repeater AP. These were all driven by a newly installed router, firewall and captive portal box (a soekris box running m0n0wall). Many, many thanks to all of you, both the regulars and the newcomers. With one less person, it would have been hard to finish in one day.
We've learnt a lot in the past year and are applying it more consistently. In particular, we've found that the more work we can do before getting onsite, the smoother the day will go. This allows more time to cope with the unexpected.
Some specific things we've learnt previously and applied well this time:
Many, many thanks to the volunteers who showed up on the day and who provided critical support beforehand, including: Seren, Drew, Jason, Michael, Dave, Dlan, Stewart, Marc, Joe, Ben, Matt and Mike S. Not to forget our president Lee, who also wrote a wonderful thank you. All your contributions were vital.
Although all's well that ended well, there were some 'learning opportunities' during the day. The reason for mentioning them here is not to dwell on them, but rather to make note so we can avoid these problems in the future if possible.
| Used for | Name & Link | Approx Price | Qty |
|---|---|---|---|
| Gateway | Soekris 4501 | $206 | 1 |
| 8MB CF card, cables | $15 | 1 | |
| Radios | HS3000 | $320 | 2 |
| Antennas | downtilt 8dBi | $65 | 2 |
| lightning protector | $20 | 2 | |
| Cables | 1.5M N-Male N-Male | $18 | 2 |
| Masts | 1" aluminum offcuts | $5 | 2 |
| Misc | Mounting hardware, electrical hardware | ~$50 | 1 |
| Volunteers | Pizza Lunch | $50 | 1 |
a work in progress - the final tally is still being worked out
Below are miscellaneous project pages, including site surveys, planning documents and installation reports. They include site surveys that didn't lead to an installation and other miscellaneous notes
On Saturday, we did a site survey at a new location, the Hourglass Park Apartments at 9505 Gold Coast Drive, San Diego 92126.
![]()
The highlights of the survey are:
Our tentative solution is to mount four APs as shown by the red dots on the map. The bottom left AP will be the master AP equipped with an 802.11a omni antenna as well as a local 802.11b AP and downtilt omni. The others will have an 802.11a directional antenna to use for a backhaul and a local 802.11b AP.
Our cost guesstimate is about $1000 per AP (for a Metrix box, added 802.11a radio, 802.11a (or parabolic) and 802.11b antennas, tripod, cables, cat-5 cable etc). This is gear we've installed several times now, so we expect it to be a predictable installation (I'm learning never to say easy!).
We'll tie it all together with another box acting as the gateway and traffic shaper. We may also put a squid proxy cache there, to better utilize bandwidth. The two main contenders are a Soekris box running m0n0wall using its 'Wonder Shaper' settings and a separate squid box for caching, or a 4801 Soekris box with a hard disk running Mikrotik which has caching built-in.
At some point, we'd really like to move away from using Pebble in the nodes due to the relative complexities of configuration (think Linux vs web-browser), but although some great 802.11b radios exist, we haven't found an affordable (indoor or outdoor) 802.11a client and/or AP we can use. Hopefully soon...