So … after more than one hour googling I found the following in the broadcom kernel module source:

if (val && strstr(v, "psk")) {
val = (strstr(v, "psk2") ? 0x84 : 0x4);
v = nvram_safe_get(wl_var("wpa_psk"));
if ((strlen(v) >= 8) && (strlen(v) < 63)) {

bcom_ioctl(skfd, ifname, WLC_SET_WPA_AUTH, &val, sizeof(val));

if (nvram_match(wl_var("mode"), "wet")) {
/* Enable in-driver WPA supplicant */
wsec_pmk_t pmk;

pmk.key_len = (unsigned short) strlen(v);
pmk.flags = WSEC_PASSPHRASE;
strcpy(pmk.key, v);
bcom_ioctl(skfd, ifname, WLC_SET_WSEC_PMK, &pmk, sizeof(pmk));
bcom_set_int(skfd, ifname, "sup_wpa", 1);
}
}
}

So … this means, that the WPA-PSK length has to be >= 8 and < 63, mine was 65. This wasn´t a problem yet, cause I used the routers only in AP mode, where this restriction doesn't effect. Shorting the WPA-PSK length 62 did the trick!

Successfull was the following modifications to factory (linksys) defaults:

nvram set vlan0ports=”0 1 2 5*”
nvram set vlan1ports=”4 5*”
nvram set vlan0hwname=”et0″
nvram set vlan2ports=”3 5″
nvram set vlan2hwname=”et0″
nvram set dmz_ifname=”vlan2″
nvram set lan_ifname=”br0″
nvram set lan_ifnames=”vlan0″
nvram set wan_ifname=”ppp0″

Now the door is open to extend the functionality of the openwrt router

# df
Filesystem 1k-blocks Used Available Use% Mounted on
/dev/root 7296 3420 3876 47% /
none 15276 36 15240 0% /tmp

Hrhrhrhr … :-) Disassemble photos can be found here

Don´t ask how, but we got some units to europe.

The first thing we does, was to install openwrt and to try debridge the switch to have multiple interfaces instead. We was able to remove ports from the switch, but cant create additional working vlans like on WRT54G. So at this point its useless for our purpose. But we will start exploring as son as possible we have a running serial console.

The following NVRAM-Settings need to take place:

#!/bin/sh
#Port 0 into WAN, 5 Router themselv
nvram set vlan1hwname=et0
nvram set vlan1ports="0 5"
#Port 2, 3 and 4 into LAN, 5 Router themselv
nvram set vlan0hwname=et0
nvram set vlan0ports="2 3 4 5*"
# Port 1 into DMZ, 5 Router themselv
nvram set vlan2hwname=et0
nvram set vlan2ports="1 5*"
# Static IP-Address for DMZ-IF
nvram set dmz_ifname=vlan2
nvram set dmz_proto=static
nvram set dmz_ipaddr=172.18.20.5
nvram set dmz_netmask=255.255.255.0
# save all the stuff
nvram commit

To bring automaticaly up the dmz-if, you need to add “ifup dmz” with:

# sed “s/ifup lan/ifup lan@ ifup dmz/” \
/etc/init.d/S40network | tr ‘@’ ‘n’ > /etc/init.d/S40network

To allow traffic forwarded by the new if, you will maybe add for example the following into “/etc/firewall.users”:

#!/bin/sh
DMZ=$(nvram get dmz_ifname)
#Allow Forward from DMZ into WAN
iptables -A FORWARD -i $DMZ -o $WAN -j ACCEPT
#Allow Forward from DMZ into LAN
iptables -A FORWARD -i $DMZ -o $LAN -j ACCEPT
#Allow Forward from LAN into DMZ
iptables -A FORWARD -i $LAN -o $DMZ -j ACCEPT

But it will be better to specify exactly, what services are allowed from and into DMZ!