If this were a live FonBar, you would log in to the hotspot through the form above.

Fon Hotspot without La Fonera hardware.

July 24, 2008

First, let’s be honest here. Fon really, really really wants you to buy a La Fonera. $20+ shipping for La Fonera 1, or $50+ shipping for La Fonera Plus, with only one LAN Ethernet jack. Fon no longer sells Linksys WRT54GL routers, and they’ve hidden the download links for the firmware necessary to “bring your own” hardware. But for the time being, that firmware is still downloadable, and so you can use your own Linksys and Buffalo brand routers.

Update: Fon has terminated their original downloads page. The links below to FonBasic and FonAdvanced still work as of 02/28/2015. The Macintosh and Ubuntu versions are now hosted by me. They’re open source products, so any take-down demands can kiss my ass. Joiku jettisoned their Fon e-partnership at the end of 2012, so that’s gone.

This firmware does not have the double-SSID feature, and other privileges might be withheld from such Fonero accounts by Fon. You may not be able to operate as a Bill Fonero (who makes money). Your hotspot contribution to Fon may not be rewarded with free roaming like everyone else. You may not be able to even register your hotspot to your Fonero account. Fon will probably continue to accept registrations of new Aliens, provide “free” trial connections, and sell wifi access at these spots. Great deal, eh?

The trick seems to lie partly in what WLAN MAC address your firmware sends back to Fon in it’s heartbeat. If it is not in the block assigned to the La Foneras which Fon sells, then you’re simply treated differently. While the formerly-official firmwares listed here are unable to clone that WLAN MAC, a little manual tweaking may fix that. There is also an encryption key which must be generated by an application installed in La Fonera firmware, but this can be provided for you by a friend.

Below are the links to download the firmware, please select the version for your router model.

FonBasic is based upon OpenWRT, and FonAdvanced is based upon DD-WRT firmware. There were also several builds of DD-WRT made with an auto-configure button in the onboard admin pages, which essentially turned it into FonAdvanced. The latest builds may still be configured for Fon by following the tutorial linked at the end of this page.

– Download FONbasic Linksys WRT54G / WRT54GL
– Download FONbasic Linksys WRT54GSv1-v3
– Download FONbasic Linksys WRT54GSv4

– Download FONbasic Buffalo WZR-RS-G54 / WHR-G54S / HP-G54

Here is the generic installation guide for the Linksys/Buffalo firmwares above: GUIDE.

– Download FONAdvanced Linksys WRT54GL / WRT54Gv3

There are several other options available for Foneros who are familiar with Linux or Macintosh OSX operating systems. These allow you to offer your own Fon hotspot, using an existing PC or Macintosh running an Intel processor. Each device needs both an Ethernet connection for the Internet feed, and a working WiFi adapter to transmit the Fon hotspot in peer-to-peer mode. You might also be able to tweak the system, and instead use two Ethernet adapters, with a simple WiFi AP connected to one of them. This would even make it possible to make your Fon hotspot capable of 802.11n!

– Download FonSpot for Macintosh OSX Tiger
– Download FonSpot for Macintosh OSX Leopard

– Download FonSpot for Ubuntu Linux

To install the Linux Fonspot, follow these steps:
1) log into your Ubuntu PC via SSH as root
2) cd /tmp
3) wget


Please note the above gzipped file contains a double-tarred file. It’s not corrupted! The inner tar file has no file extension. Please adjust the command on the next line as necessary. I’m leaving it unfixed so that it is the genuine file distributed by Fon.

4) tar zxvf fon_linuxspot_beta0.2_es.tar.gz -C /
5) > fonspot

You will need to either launch Linux Fonspot manually, each time you boot up, or manually add it to your startup script.

There is also FonJoikuSpot, which is a Fon-themed skin for Joiku’s JoikuSpot application which runs on a number of Samsung and Nokia phones. In original press releases, this was unwisely called “FonSpot” which re-uses the name of the Mac/Ubuntu FonSpot product above.

– Purchase FonJoikuSpot

Let me know if any of these firmwares can no longer be downloaded, since I don’t check them often. Do I have copies of all of this software? You betcha. When Fon finally yanks their own copies down, i’ll put up rapidshare or bittorrent links. ;)

Finally, it is realistically possible to make a fully Fon-compatible hotspot using any PC or router running Linux-type operating systems, if there is also a version of Chilispot or Coovachili which works on it. Fon’s router firmware is a stripped-down edition of OpenWRT, so any router which runs this is an excellent candidate, even if you don’t use OpenWRT itself.

For example, this tutorial will instruct you to set up a Fon hotspot on any router running the latest DD-WRT firmware, including cloning a MAC address which Fon likes, and setting up the “Fon heartbeat” so that your device appears on their maps.

Flashing La Fonera over Serial Port

February 8, 2008

Here are instructions for restoring your FON firmware entirely through the serial connector. Most instructions which i’ve seen on the web assume that you have telnet over Ethernet access to Redboot, which is a chicken and egg problem!

EDIT: ChrisPHL points out that I can enable telnet over Ethernet before I even init or flash any firmware by using the RedBoot FCONFIG command: FreeWLAN.info. So why follow this tutorial? While serial console may be slower than uploading via Ethernet, you’ll save time because you won’t need to set up TFTP server, manually configure TCP/IP, rearrange cords, change cords back, reconfigure DHCP, etc.

This tutorial worked just fine for my La Fonera 1.0 (FON2100). If you have the La Fonera 1.1 (FON2200), 1.5 (FON2201), or 2.0 (FON2202), you may find that telnet over Ethernet is allready enabled! One reader has informed me that his newer FON2200 seems to have an *older* version of RedBoot (V1.00 – built 10:37:27, Dec 12 2006) installed on it than mine (V1.3.0), and that the memory range begins at a different address. If this tutorial doesn’t seem to do the trick, try k0k0′s German tutorial, which uses different addresses starting with the second ‘load’ command. FON2201 and FON2202 use different firmware and are based on yet another circuit board. They will certainly require different load addresses.

It is possible to transfer the files using XMODEM or YMODEM if you use a terminal emulator like HyperTerminal. ZMODEM would be even faster and more accurate, but I was unable to get that to work. When I used HyperTerminal, I am pretty sure I used hardware handshaking, but k0k0, administrator of FreeWLAN’s forums recommends setting this to NO handshaking. This may be necessary if you can receive text from the serial port, but cannot get it to respond to keystrokes.

The two firmware files, rootfs.squashfs and kernel.lzma were aquired from this archive, and are stored on my local hard drive. I did not set up a TFTP or web server, as that would require a network connection, and is again, a chicken and the egg problem. :wink:

To start with, I have built a working serial voltage adapter, as seen in my previous post, interrupted the bootup with CTL-C, and executed the following commands in Redboot:

1) RedBoot> baudrate 115200 (much faster connection, but I needed to close and restart HyperTerminal using the new speed)

2) RedBoot> fis init -f (this deletes all of the onboard firmware!)

typical response from RedBoot:
About to initialize [format] FLASH image system – continue (y/n)? y
*** Initialize FLASH Image System
… Erase from 0xa87e0000-0xa87f0000: .
… Program from 0x80ff0000-0×81000000 at 0xa87e0000: .

The following commands and memory addresses are taken directly from the DD-WRT tutorial on “Reflashing LaFonera original firmware“, except that i’ve gotten the files I need by other means, and i’ve adjusted the commands for using YMODEM over the serial console instead of TFTP server at a fixed IP. You may use XMODEM if you choose instead, but it is a bit slower. If you must use XMODEM, and it will not start, try switching your terminal emulator from hardware handshaking to XON/XOFF – or vice-versa.

3) RedBoot> load -r -m ymodem rootfs.squashfs -b 0×80040450

typical response from RedBoot:
CCCCRaw file loaded 0×80040450-0x801c044f, assumed entry at 0×80040450
xyzModem – CRC mode, 2(SOH)/1536(STX)/0(CAN) packets, 6 retries

Whew! That was fun! I haven’t used YMODEM since the early 1980′s! As you see “xyzModem” implies that ZMODEM is supported, but the command “-m ZMODEM” is rejected by RedBoot. YMODEM and XMODEM may sit idle for a while before they start transferring. Be patient. :lol:

4) RedBoot> fis create -b 0×80040450 -f 0xA8030000 -l 0×00700000 -e 0×00000000 rootfs

typical response from RedBoot: (THIS CAN TAKE A LONG TIME!)
… Erase from 0xa8030000-0xa8730000: ……………………………………
… Program from 0×80040450-0×80740450 at 0xa8030000: ……………………..
… Erase from 0xa87e0000-0xa87f0000: .
… Program from 0x80ff0000-0×81000000 at 0xa87e0000: .

5) RedBoot> load -r -m ymodem -b %{FREEMEMLO} kernel.lzma

typical response from RedBoot:
CCRaw file loaded 0×80040800-0x800c07ff, assumed entry at 0×80040800
xyzModem – CRC mode, 2(SOH)/512(STX)/0(CAN) packets, 4 retries

6) RedBoot> fis create -r 0×80041000 -e 0×80041000 vmlinux.bin.l7

typical response from RedBoot:
… Erase from 0xa8730000-0xa87b0000: ……..
… Program from 0×80040800-0x800c0800 at 0xa8730000: ……..
… Erase from 0xa87e0000-0xa87f0000: .
… Program from 0x80ff0000-0×81000000 at 0xa87e0000: .

7) RedBoot> fis load -l vmlinux.bin.l7

typical response from RedBoot (after a really long pause):
Image loaded from 0×80041000-0x801ba000

8) RedBoot> exec

typical response from RedBoot:
Now booting linux kernel:
Base address 0×80030000 Entry 0×80041000

At this point the serial connection froze. I powercycled La Fonera and observed Redboot come up, and then the serial connection froze again shortly after stating that it was booting the linux kernel… but Wireless Connection Manager showed that MyPlace had been created and I was able to access the onboard web admin. The router is now factory-fresh, circa firmware version 0.7.1 r1! 8)

Next, i’ll leave the Ethernet disconnected, and configure the fonware over a wifi connection to load FreeWLAN. Once that is working, then i’ll install the CAMICIA modified bootloader over SSH *before* I begin experimenting with configuration changes again. ;)

EDIT: The following page of RedBoot Command Line Options helped me a lot in making this tutorial: AdvancedRelay

Building a Cable to Debrick La Fonera WIFI Router

February 8, 2008

Well, all great minds screw up once in a while. I was thrilling away with my La Fonera 1.0, freshly hot-rodded with FreeWLAN v0.9.2, when the Fon came to a screeching halt! I was trying to do something Really Cool, and set it up as a Transparent Ethernet bridge. In this mode, the La Fonera would work as a wifi client device. The WAN Ethernet port would be repurposed as a LAN port, which would be bridged to the upstream LAN and DHCP server. This way, I could turn my tiny USB-Ethernet print server into a wireless one.

Well, it turns out that FreeWLAN’s QRM implementation isn’t quite working perfectly. To make matters worse, I can’t just hold down the ‘ole reset button because that button is ignored until the firmware finishes booting and polls it! This La Fonera isn’t finding the WLAN I configured it to join, so it isn’t setting up it’s virtual interfaces. I’m told that it’s stuck in this incompletely booted state forever. All I can do is ping it under very particular circumstances. No SSH, and no web admin exist any more.

Proponents of FreeWLAN advise flashing the kernel ASAP with one which allows reflashing the firmware over the Ethernet cable. I have done this before, when I was using DD-WRT for the La Fonera, but had not yet done it with this particular router. This leaves only flashing by serial connector. This is often referred to as a “JTAG” connector, but technically the La Fonera just has a serial connector that is simply at a lower voltage (TTL) than the serial port (RS232) you may have on the back of your PC. This requires a voltage-level adjustor. The folks at FreeWLAN were very helpful in providing me a list of options, and I decided that I would build the serial adaptor myself.


La Fonera 1.0 (FON2100) (left), (right) La Fonera 1.1 (FON2200)

The popular design utilizes a Maxim 232 or 3232 integrated circuit. Maxim will provide free samples of this part, with free shipping from their website. I ordered two, which arrived about a week later.

I went to Radio Shack, our local overpriced electronics parts store, for 5 polarized tantalum capacitors, a small breadboard, and a 9-pin female serial connector. The bill came to $12.91 with tax.

I used sections of an old floppy cable for wire and for the connector to the La Fonera, as the holes were exactly right.

As luck would have it, the first one I built didn’t work properly. On my first trip to Radio Shack, I had bought slightly cheaper nonpolarized electrolytic capacitors. The MAX3232 datasheet said that nonpolarized would work, but perhaps that is not so for this particular project. I’m happier with the way the much smaller tantalum capacitors look, anyway.

We have RedBoot!

Also, if I let it boot up uninterrupted, I can hit ENTER for a telnet session to the OpenWRT firmware which the fonware is based on:

Next up is flashing the CAMICIA edition of the linux kernel which permits access to Redboot over the Ethernet port. I may choose XMODEM to transfer files while connected to the serial port. Then i’ll switch to Ethernet to more quickly flash the 0.7.1 edition of fonware which works best with FreeWLAN. Switching to wifi, I’ll manually configure fonware to download FreeWLAN right away, before I ever connect the Ethernet to the Internet, preventing further fonware updates. Fonware updates get slipstreamed into future FreeWLAN editions, and thus the router really does stay up-to-date.

Make your hotspot mobile with La Fontap

October 12, 2007

Here’s a little project I actually did some months ago. I hope it inspires a wave of (legal) guerilla hotspot activity. Milk your wifi and bring affordable Internet to a hotel or cafe near you!

Some people have discussed tapping a USB connection for 5v DC. You can also tap a PS/2 keyboard port (if you have one) for 5v without any additional circuitry. The tap I have wasn’t entirely built by me. It was provided by Logitech to supply power to an old webcam. It can connect to both large and small keyboard connectors, and has an extra side wire where the 5v is split off. I stripped the wires and determined which one was + and – by trial and error. The power connector was cut off from some other transformer. I keep lots of small parts like this.

Here is a photo of a PS/2 connector showing which pins you need to tap:

Here is a photo of my La Fonera resting comfortably with it’s new power connector:

Here is La Fonera behind my trusty old laptop, showing that it is indeed working with the laptop keyboard port as power source, and Ethernet jack as Internet source. Sorry it is underexposed, I wanted you to see the glowing LEDs better. I hope you can see, on La Fonera I have power, Internet and WLAN lights all working, and also the link light on my Ethernet jack. Click photo for larger version:

Finally, it was necessary to enable Internet Connection Sharing (ICS), which is included with most versions of Windows. Alternatives and equivalents exist for every major operating system.

My Internet source is my WPA encrypted Linksys router, and I need to share it with my La Fonera, which is connected to the Ethernet jack. Sharing can only be enabled for one network device, and it is automatically assumed that every other network device will be bound to it. Note that ICS does not appear as a menu choice unless your computer has at least two enabled networking devices. Under Network Connections, I select the wifi adapter, NOT the Ethernet jack, and enable ICS on the Advanced tab:

Now, what can you use this for? Perhaps you are unable to run an Ethernet cable out to your La Fonera, but are within range of another hotspot which you are permitted to access. Perhaps you would like to provide a Fon hotspot for a group of people, and have a cellular data, WiMax or other wireless modem device to supply the Internet connection. It may even be possible to pay for a connection to an expensive commercial hotspot, and spend a day making some positive income by reselling it at Fon’s cheaper rates to everyone else there. You could even use an existing Fon hotspot; pay for a Fon daily pass, and then resell another Bill’s wifi for your own profit (please get his permission first)!

This arrangement should work to supply at least a basic Internet connection, for WWW and email. It is probably a poor substitute at best, for true WDS meshing, to extend the range of your wifi. Performance will certainly suffer due to latency and the effects of performing NAT behind another NAT. Lastly, ICS does not always recognise unusual network devices, especially ones which require special drivers. Some ISPs may require such drivers to help enforce their one-computer-per-customer Terms of Service.

I’d love to hear from anyone who has milked another wifi hotspot like this. ;)

Wifi Reflections [1 EDIT]

May 22, 2007

I’ve been playing around with a pair of 6-inch parabolic reflectors, based on the “Windsurfer” design found here at Freeantennas.com, and thought i’d share my luck so far. I have my trusty Linksys WRT54GL router inside the house, and myself positioned about 40 (12m) away, on the front porch. I use DD-WRT, so I have boosted the transmitter’s power output to 125mW. The house is all wood-frame construction with no obstacles other than a metal gas stove in the line of sight. I use an Orinoco Gold A/B/G PCMCIA wifi card, which has a reputation for reasonably accurate strength readings when using NetStumbler.

Click the photo for a large version:

At first, I just ran NetStumbler with the parabolic dishes both pointed toward my computer. I get about -63db, which is an excellent signal. Second, I turned both dishes in the opposite direction. The signal plunges to about -78db. Third, I took the parabolic reflectors off to see the signal I get without assistance. This is around -68db which is fair to excellent, but it experiences occasional complete dropouts. I rarely get these dropouts now that i’m using the reflectors. :)

Here’s a Shockwave Video tutorial on building the Windsurfer. For my own reflectors, I used tape, cardstock paper and an Exacto knife, and got neater looking results. When you’re done, your router should resemble K-9 s head.

There were some very interesting pictures on Freeantennas.com that you might be interested in seeing: Deep Dish Cylindrical Parabolic Template and Lots More Pictures.

An excellent parabolic reflector design is also provided by fellow Fonero Kyros (.pdf format). While the Windsurfer design states that the template can be scaled up proportionately, Kyros argues otherwise.

Since my 6 reflectors are delivering less of a boost than the notes on the Windsurfer template suggest, i’m going to take my chances and build a pair at double size.

EDIT: I made reflectors at 150% the scale of the small ones (about 10 ). They’re so big that they can’t both point in the same direction without overlapping a bit. While the new reflectors are still better than none, the smaller reflectors outperform them by about -5db. Can anyone offer advice about what “sweet sizes” these reflectors should be built at? If they can’t be scaled up proportionately, then what is the next larger size I should construct at?

Still waiting for USB? Add SD today!

May 22, 2007

The good people at Hackaday have allready brought us the tutorial on adding an SD card to a Linksys router.

Now there’s a similar enhancement for the La Fonera 1.0!

It seems to me that the Laffy mod could also be done with an old floppy cable connector just like the Linksys mod. Let us know if you fried your El Cheapo trying this mod out. Also, let us know how well it works for you! :)