WOL Forwarding

How to forward Wake-on-LAN and DHCP traffic from one subnet to another subnet.

Cisco's implementation

DHCP Forwarding

We shall assume you wimped out configuring your own DHCP server (if you do not know about 'ip helper-address') and your FOG server is the center of life on your network. The IP of your FOG server is 10.10.10.1.

If an IP helper address is specified and UDP forwarding is enabled, broadcast packets destined to the following port numbers are forwarded by default.

  Time Service             Port 37
  TACACS                   Port 49
  Domain Name Services     Port 53
  Trivial File Transfer    Port 69
  DHCP (BootP)             Port 67 and Port 68
  NetBIOS Name Server      Port 137
  NetBIOS Datagram Server  Port 138

To have the Cisco IOS software forward User Datagram Protocol (UDP) broadcasts, including BOOTP, received on an interface, use the ip helper-address interface configuration command. To disable the forwarding of broadcast packets to specific addresses, use the no form of this command.

ip helper-address 10.10.10.1

no ip helper-address 10.10.10.1

Now you want to turn off broadcast forwarding for all of the other services, you would have to be crazy to want them to spill over, with:

no ip forward-protocol udp time
no ip forward-protocol udp tacacs
no ip forward-protocol udp domain
no ip forward-protocol udp tftp
no ip forward-protocol udp netbios-ns
no ip forward-protocol udp netbios-dgm

N.B. these affect only broadcast traffic on these UDP ports, not the functionality of, for example, unicast TFTP traffic on your network

WoL Forwarding

To actually forward the WoL packets to VLAN's without opening yourself up to being the source of a Smurf Attack's you need to use 'ip directed-broadcast' with care. You create a standard access-list (numbered '50' in our example):

access-list 50 remark directed broadcast permits (ie WoL)
access-list 50 permit 10.10.10.1

and for all the VLAN's you want to use WoL on you slip into the configuration:

ip directed-broadcast 50

If you want to be able to send WoL packets from other machines on your network then obviously add additional whitelisted of IP's to the access-list.

Alas we have not finished yet, we need to fix some serious problems in FOG servers methology when doing WoL. It has no concept of support for cross-subnet WoL and shockingly you need to use sudo to create a UDP packet that can be created by a regular user; using root pointlessly (a webserver should never run a command directly as root).

As most of your are Deadrat weenies (Debian users just type 'aptitude install wakeonlan') so you should from download the wakeonlan tool (the wakeonlan-<version>.noarch.rpm file) and install it running as root:

rpm -i wakeonlan-<version>.noarch.rpm

If you prefer Mac computers - then you can use osx safe mode Once installed just edit '/var/www/html/fog/wol/wol.php' to match something like:

<?php
require_once( "../commons/config.php" );
require_once( "../commons/functions.include.php" );

$mac = $_GET["wakeonlan"];
if ( isValidMACAddress( $mac ) )
{
        $output;
        $ret = "";

        # ewwwww GAH, yuck, barf, wtf?
        #exec ( "sudo /sbin/ether-wake -i " . WOL_INTERFACE . " " . $mac, $output, $ret );

        exec ( "/usr/bin/wakeonlan -i 10.10.12.255 " .  $mac, $output, $ret );
        exec ( "/usr/bin/wakeonlan -i 10.10.13.255 " .  $mac, $output, $ret );
        exec ( "/usr/bin/wakeonlan -i 10.10.14.255 " .  $mac, $output, $ret );
}
?>

The IP's '10.10.1[234].255' are the broadcast addresses of the VLAN's you want to send WoL packets too; the above example will mean that the suitable WoL packets for the MAC address you are interested in will be sent to the subnets '10.10.1[234].0/24'.

This will probably be made much nicer once the authors find this and make FOG subnet aware (guys please do not use the last IP of the workstation, it might have moved subnets, WoL packets should be duplicated to every VLAN separately).

WoL With 802.1x

Just amend your usual 802.1x per-port configuration section to have:

switchport access vlan <unauthorised VLAN ID>
dot1x control-direction in

This means that you send your WoL packet to the broadcast address of the VLAN with the number ID that you put in place of '<unauthorised VLAN ID>' and your workstations should still wake up...whilst you still benefit from the goodness of 802.1x.

Dell™ PowerConnect™ 6024/6024F Systems

The following example enables the software to forward UDP broadcasts on interface 1.100.100.0 to IP address 172.16.9.9 to ports 49 and 53.

Console(config)# interface ip 1.100.100.0

Console (config-ip)# helper-address 172.16.9.9 49 53

Juniper's implementation

host1(config)#set dhcp relay 192.168.29.10

Enterasys Matrix Router

This example shows how to permit UDP broadcasts from hosts received by VLAN 1 to reach server 191.168.1.24 and broadcasts received by VLAN 2 to reach server 192.24.1.10:

matrix-x(switch-su)-> router
matrix-x(router-exec)# configure
matrix-x(router-config)# ip forward-protocol udp
matrix-x(router-config)# interface vlan.1.1
matrix-x(router-config-if-vlan-1)# ip helper-address 192.168.1.24
matrix-x(router-config-if-vlan-1)# exit
matrix-x(router-config)# interface vlan.1.2
matrix-x(router-config-if-vlan-2)# ip helper-address 192.24.1.10

The Simple One Modification Method: Modify wol.php

For FOG ver 0.29 with wakeonlan. Just modify your wol.php file in /var/www/fog/wol/.

This is an option that allows you to route the magic packet by using the optional -i switch with wakeonlan. The -i switch in the wakeonlan program accepts either an ip address or computer name (DNS).

The best part is that there is no broadcasting setup needed.

Unfortunately, this will only work for as long as the ARP cache is held on your switches. For Cisco, the default is 4 hours.

You can simply add code to query the MySQL database using the MAC address to pull the computer name, which is then inserted (along with the MAC) into the wakeonlan command for the -i switch. The packet is then directed exactly where it needs to go, as long as the computer has been inventoried with the correct PC name used in DNS.

There are likely improvements that can be made, such as passing the FOG variables in from the FOG config file instead of hardcoding here for username and password, as well as error checking, improved coding, or anything else that could help, but nonetheless it is a very simple solution for WOL accross a WAN.

Here is the modified wol.php code: (You may want to save a copy of the original wol.php first and modify your variables)

@error_reporting(0);
function __autoload($class_name) 
{
	require( "../lib/fog/" . $class_name . '.class.php');
}
$mac = new MACAddress($_GET["wakeonlan"]);                                         #########  <---This is the same

	#Added by Bwild 1/7/11:
	###################### Modify these variables below if needed.
	$mysqlserver = "localhost";
	$mysqlusername = "yourusername";
	$mysqlpassword = "yourpassword";
	$dbname = "fog";
	######################

if ( $mac != null && $mac->isValid( ) )                                            #########  <---This is the same
{
	$conn = mysql_connect("$mysqlserver", "$mysqlusername", "$mysqlpassword");  ##############   This section is new; it is the MySQL database query.
		if (!$conn) {
  		die('Could not connect: ' . mysql_error());
		}
	mysql_select_db("$dbname");

	$sql = "SELECT hostName from hosts WHERE hostMAC = '$mac'";
	$hostrow = mysql_query($sql);

	if (!$hostrow) {
		die('Invalid query: ' . mysql_error());
		}

	$hostname =  mysql_fetch_row($hostrow);                                     ##############   End of the query.
##### This will wake up on the same subnet (doesn't cross routers)
	$wol = new WakeOnLan($mac->getMACWithColon());
	$wol->send();

##### This will wake up over a WAN (routed with the IP listed w/ this MAC in the HOSTS table in MySQL)
	exec ( "/usr/bin/wakeonlan -i " . $hostname[0] . " " . $mac );
		
}

Thanks and credit to the earlier contributors that led to this wol.php solution. --Bwild 20:36, 7 January 2011 (UTC)