My landline NBN VDSL internet connection speed is pretty limited. The maximum sync speed I can achieve is only around 30Mbps. With the rollout of 5G around the country, a lot of telcos in Australia is starting to offer 4G mobile broadband plans with generous 500GB per month data caps. I have been really tempted to jump onto 4G to use as my house internet connection instead. Doing a speed test on my phone on 4G at various times for the past few days, I can get about 100Mbps off-peak and around 65-80Mbps during peak hours.

I looked around for a suitable 4G gateway modem/wifi router but found the choices a bit of a compromise, some 4G gateway modems have limited configurable options and others have speed caps baked into their firmware. Also, some telcos will limit your speed if they detect that you are using a router device as opposed to a phone.

I have a few older S905x Android TV boxes with 1GB ram lying around which I stopped using because running dodgy Android firmware with 1GB ram is frankly subpar. I have been repurposing them for various purposes like running Home Assistant and pihole. They are pretty good for those applications, pretty much anything you would run using a Raspberry PI, you can do it better using one of these Android TV boxes. I will be showing you how to install OpenWRT onto one of these boxes.

For the actual 4G modem part, I will be using an old Android phone that I am not using anymore, a Samsung Galaxy Note 5 running in USB tethering mode. You should be able to use any old Android phone. In this configuration, I can eventually upgrade the setup to a cheap Android 5G phone later when 5G becomes available in my area. As a side note, network unlocked 5G gateway modem is non-existent at the moment.

Hardware requirements:

1. S905/S905x/S905w/S912 Android TV Box. If you are buying a new Android TV Box, I recommend getting one with a gigabit LAN port as your internet connection may be limited by the LAN port connection.

2. Android Phone

3. MicroSD card, preferably Class 10 and above.

4. RJ45 Cat5 and above network cable, which is your typical LAN network cable. Cat5e and above if your LAN port is a gigabit port.

5. USB cable to connect the Android TV box to the phone.

6. TV with spare HDMI input

Optional hardware:

1. USB Keyboard

Software requirements:

1. Download the OpenWRT firmware for your Android TV Box:

2. Rufus or balenaEtcher to burn the firmware onto the microSD card.

Instructions:

Section 1: Prepare the MicroSD card

Step 1: Go to https://pulpstone.pw/openwrt-18-06-2/ and download the firmware under SBC that has S905x in it.

Step 2: Burn the image onto the microSD card using Rufus or balenaEtcher.

Section 2: Prepare the Android TV box

Step 1: Insert the microSD card you prepared in Section 1 into the Android TV box.

Step 2: Connect the Android TV box to the HDMI input of your monitor/TV and the LAN port of the Android TV box to your laptop/PC LAN port. If you have a PC and cannot move it to the TV, you can unplug and move the Android TV box to your PC after Step 5.

Step 3: You need to boot into the recovery mode of your Android TV box. Some Android TV boxes have a reset pin hole, you will need to hold it down while plugging in the power to get it to boot into recovery mode. If your Android TV box does not have a reset pin hole, boot into the TV box and there should be an “Update” or “Update & Backup” app under “Apps”. Select any zip file and click “Update”. It doesn’t matter which zip file you select, but you do need a zip file to select to trick your Android TV box to boot into recovery mode. In extreme cases, where there is no zip file for you to select, you will need to insert the microSD card back into your computer and just create an empty text file and call it dummy.zip.

Step 4: When the Android TV box boots into recovery mode, there should be a whole bunch of text flying past your screen.

Step 5: Wait for the text to finish loading, which is after a few minutes and the text has totally stopped flying up your TV.

Step 7: Plug your 4G Android phone into any USB port of your Android TV box. Under notifications, you should be able to select what mode the USB connection should be. Select “USB tethering”. Turn the Android phone Wifi off, so that it is using 4G to access the internet.

Step 8: You should be able to surf the internet through the Android phone’s 4G connection.

At this point, if you are reading up to here, you might be thinking, this seems like a lot of work when I can just use the 4G Android phone in Wifi hotspot mode.

From this point onwards, I am extending the setup to share the 4G connection with the rest of the devices in my house, both wired and wireless.

Section 3: Setting up the Android TV box as the main network gateway

Step 1: Check the DHCP range of main wifi router. For my wifi router, the setup is this:

IP Address: 10.0.0.138
DHCP Range: 10.0.0.1 to 10.0.0.137

Note: if you are not familiar with networking, a typical wifi router can theoretically issue 253 IP addresses to clients. This is limited by the way IP addresses are organised, where each number before the dots can only range from 1 to 254. My wifi router has a non-common IP address of 10.0.0.138. Common wifi router IP addresses are usually 192.168.0.1 or 192.168.1.1, so your router IP address is probably one of the 2 IP addresses.

Step 2: Pick an IP address outside of the DHCP range. In my case, I chose 10.0.0.139.

Step 3: Log into the Android TV box web interface. Open a browser window on your computer and type in 192.168.1.1. The default username is root and the password is also root.

Step 4: On the left hand navigation, click on Network > Interfaces. You should see the one that says “LAN” under the Interfaces window. Click on Edit.

Step 5: Under this General Setup tab, the only thing you need to change is the “IPv4 address”. But in case the options are different, the other important options should be:

Protocol: Static address
IPv4 address: {IP address you have chosen}
IPv4 netmask: 255.255.255.0
IPv4 gateway: {leave blank}

Step 6: Click the “Save” button in the bottom right corner. You can also click “Save & Apply”, but sometimes there are problems with saving option in OpenWRT, so I always click “Save” and then “Save & Apply” just to be on the safe side.

Step 7: After you saved and applied the changes, the IP address of the Android TV box is now 10.0.0.139 or the IP address you had chosen. The page may stop loading, because the IP address is no longer 192.168.1.1. Wait for a few minutes, and then type in 10.0.0.139 or the IP address you had chosen.

Step 8: Go back to the “Interfaces – LAN” screen by clicking on Network > Interfaces > LAN > Edit.

Step 9: Now we need to turn off the DHCP server on the Android TV box, otherwise it will clash with your main wifi router when you plug the Android TV box into your network. At the bottom of the screen, you will see a section called “DHCP Server”. The first option is “Ignore interface”, tick it. Then click “Save”, then “Save and Apply”.

At this point, you are ready to plug the Android TV box into your main network.

Section 4: Change main router settings to use Android TV box as the internet connection

Step 1: Plug the LAN network port of the Android TV box into a spare LAN port on the main router.

Step 2: Open the settings page of the main router. There are too many different brands and they all have different interfaces. You need to find the settings section where the DHCP settings are kept. Under the Network gateway/Internet gateway/Gateway setting, set it to the Android TV box IP address, which in my case is 10.0.0.139. Save the setting.

You can now unplug your wired internet connection and see if you still have internet. If not, reboot your router for the new settings to take effect.

Note:

Recently, my company is moving our web hosting to Amazon Web Services or more commonly known as AWS. For security purposes, it is always a good idea to only expose certain ports to the internal network only and not have it exposed to the entire internet. However, as a developer, I need those ports exposed so that I can upload files or easy access to the database through the database workbench software. This will require me to be authenticated to the internal network, so that I can get access to those ports.

To do this, I will need to setup Client VPN to the internal network using a method called mutual authentication. However, I have found that documentation on both AWS and other sites on the internet were outdated on EasyRSA and I had figure it out on my own. Below are the steps I took to do the setup:

Section 1: Generate server and client certificate keys

Step 1: As a prerequisite, OpenVPN needs to be installed with EasyRSA 3 Certificate Management Scripts selected. Go to OpenVPN community downloads: https://openvpn.net/community-downloads/

Step 2: Download the 64-bit MSI installer. Most computers nowadays should be running on a 64-bit processor, if you are sure that your processor is 32-bit, then download the 32-bit version.

Step 3: Run the MSI installer and you will arrive at the screen below. Choose Customize.

Step 4: By default, “OpenSSL Utilities” is not selected. Select “OpenSSL Utilities” and “EasyRSA 3 Certificate Management Scripts” and click “Install Now”.

Step 5: After OpenVPN has been installed, run cmd.exe in Administrator mode. If you are not sure how to do that, the easiest way is to type cmd into the search bar and right click to see the option.

Step 6: Navigate to “\Programs Files\OpenVPN\easy-rsa” folder. Then run “EasyRSA-start.bat”. And you should see the EasyRSA Shell prompt.

Step 7: Run this command to initialize the environment and setup the folder structure for the client PKI.

./easyrsa init-pki

Step 8: Generate the Diffie–Hellman key. This key makes it possible to exchange cryptographic keys between the server and clients securely.

./easyrsa gen-dh

Step 9: Generate the Certificate Authority chain certificate.

./easyrsa build-ca nopass

Step 10: Generate the private and public keys of the server. In this tutorial, the server is named OVPN-SERVER, you may call the server another name.

./easyrsa build-server-full OVPN-SERVER nopass

Step 11: The command below will generate the client’s private key and it’s Certificate Signing Request (CSR). The client in this tutorial is called Client1. You may change this to be called something else to reflect the client.

./easyrsa gen-req Client1 nopass

Step 12: Now, sign the client CSR.

./easyrsa sign-req client Client1 nopass

Now all the required certificate files are generated. Check the files in the folders:

Client Key: C:\Program Files\OpenVPN\easy-rsa\pki\private\Client1.key
Server Key: C:\Program Files\OpenVPN\easy-rsa\pki\private\OVPN-SERVER.key
Client Cert: C:\Program Files\OpenVPN\easy-rsa\pki\issued\Client1.crt
Server Cert: C:\Program Files\OpenVPN\easy-rsa\pki\issued\OVPN-SERVER.crt
CA cert: C:\Program Files\OpenVPN\easy-rsa\pki\ca.crt

Section 2: Import Certificates into AWS Certificate Manager

Step 1: Goto https://console.aws.amazon.com/acm/home

Step 2: Choose “Import a certificate” to import the server certificate.

Step 3: On the Import a certificate page, copy/paste the content:

From the OVPN-SERVER.crt file to Certificate body.
From the OVPN-SERVER.key file to Certificate private key.
From the ca.crt file to Certificate chain.

Note: the crt and key files are text files, all you need to do is open them up in your favourite text editor and copy/paste the content.

Step 5: Choose “Import a certificate” again to import client certificate:

From the Client1.crt file to Certificate body.
From the Client1.key file to Certificate private key.
From the ca.crt file to Certificate chain.

Section 3: Create a new Client VPN endpoint

Step 1: Open the Amazon VPC console at https://console.aws.amazon.com/vpc/.

Step 2: In the navigation pane, choose “Client VPN Endpoints” and then choose “Create Client VPN Endpoint”. If you want, you can give the endpoint a name and description, but this is optional.

Step 3: For IPv4, specify an IP address range, in CIDR notation, from which to assign client IP addresses. For example, 10.0.0.0/22. I used 192.168.0.0/22 because the example IP address range clashed with my computer’s internal LAN IP address subnet.

Step 4: For Server certificate ARN, specify the ARN for the TLS certificate to be used by the server. If you have done section 2, correctly, both the server and client certificates you uploaded previously should be showing in the dropdown. Choose the server certificate.

Step 5: Specify “mutual authentication” as the method to be used to authenticate clients, and then for Client certificate ARN, specify the ARN of the client certificate that you uploaded previously in Section 2.

Step 6: Choose No for “Do you want to log the details on client connections?“

Step 7: Leave the rest of the default settings, and choose “Create Client VPN Endpoint“.

Note: After you create the Client VPN endpoint, its state is “pending-associate”. You can immediately move on to Section 4 without waiting for anything else to happen.

Section 4: Enable VPN connectivity for clients

To enable clients to establish a VPN session, you must associate a target network with the Client VPN endpoint. A target network is a subnet in a VPC.

Step 1: Continuing from the previous section, after the VPC has been created, in the lower section of the screen, there should be an “Associations” tab. Click on it and then choose “Associate“.

Step 2: This should take you to a screen with 2 dropdowns. On the first dropdown labeled “VPC”, select the VPC that you have just created.

Step 3: For the “Choose a subnet to associate”, choose your preferred subnet to associate with the Client VPN endpoint.

Step 4: Choose “Associate”.

Note: It can take a few minutes for the association light to turn green, you can move on to the next section without waiting for this to happen.

Section 5: Authorize clients to access a network

To authorize clients to access the VPC in which the associated subnet is located, you must create an authorization rule. The authorization rule specifies which clients have access to the VPC. In this tutorial, you grant access to all users.

Step 1: Following the last section, now choose the “Authorization” tab, and then choose “Authorize Ingress“.

Step 2: For Destination network to enable, enter CIDR of the network that you entered in Section 3, Step 3.

Step 3: For Grant access to, choose Allow access to all users.

Step 4: Choose Add authorization rule.

Section 6: Download and setup the Client VPN endpoint configuration file

Step 1: Following section 5, on the VPC homepage you should see a Download Client Configuration button, choose it and download the file.

Step 2: Find the client certificate and key files that you generated in Section 1.

Step 3: Locate the configuration file that you downloaded in Step 1 and open it using your favourite text editor. Find the line just after the closing tag of the ca section “”.

Step 3: Put the contents of the crt file between and the contents of the private key between . Paste the following into the configuration file:

Contents of client certificate (.crt) file



Contents of private key (.key) file

Step 4: Prepend a random string to the Client VPN endpoint DNS name. Locate the line that specifies the Client VPN endpoint DNS name, and prepend a random string to it so that the format is random_string.displayed_DNS_name. On the fourth line in the configuration file, you will find the endpoint dns name, for example:

remote cvpn-endpoint-0102bc4c2eEXAMPLE.prod.clientvpn.us-west-2.amazonaws.com 443

Change it to:

remote adwdertf.cvpn-endpoint-0102bc4c2eEXAMPLE.prod.clientvpn.us-west-2.amazonaws.com 443

Step 5: Save and close the configuration file.

Section 7: Setup and connect to VPN using OpenVPN Connect.

If you have installed OpenVPN correctly on your computer, you should have an app called OpenVPN GUI. If you are not sure where it is, user your Windows search bar to look for it. Click on it to run it. You should now have the app running in the background in your taskbar.

Step 1: Run OpenVPN GUI. Find the icon in your Windows taskbar and right click on it.

Step 2: You should select “Import file…” and select the OpenVPN configuration file you saved in Section 6. The file should end with .ovpn extension.

Step 3: Once selected, the OpenVPN GUI app should start connecting to the VPN you created. Congrats!