In my last post I talked about getting my home router up and forwarding packets from nothing and getting my computers connected via Ethernet. The next step is to get 802.11 (WiFi) working.
In my last post, I mentioned that I got the Intel 7260-ac card, which I've had some problems with. Intel decided to code into the EEPROM that the card can only use channels that make it compliant with every country's laws, and the firmware and Linux driver dutifully read this information and comply. This means that the card can only work in AP mode on channels 1-11, and will NOT in the 5GHz band. This means that you're stuck to the noisy 2.4 GHz band and can't even use 802.11ac (since it requires 5GHz).
I've seen some various blog and forum posts where the OpenWRT people have gotten around this on cards with atheros chipsets since it's just a check in the driver. However, in the small amount of kernel driver hacking I've done, I've been unsuccessful.
Long story short, watch which card you pick up and make sure people have had luck making it do what you want to, preferrably without having to patch kernel drivers.
Since you're turning your router into a wireless access point, you have two options to connect clients to your network: split them off into their own network segment in a different subnet, or bridge the wireless interface in with your inside network and let wireless users mingle with your wired users. I chose the latter, since it was simpler.
The basic idea is that you create a bridge device (
br0) and bridge in your
wlan0 interfaces. My updated config shows the changes you need to make to
auto lo iface lo inet loopback # outside allow-hotplug eth0 iface eth0 inet dhcp hwaddress ether AA:BB:CC:DD:EE:FF dns-search home.nickpegg.com nickpegg.com dns-nameservers 22.214.171.124 126.96.36.199 # inside iface eth1 inet manual iface wlan0 inet manual auto br0 iface br0 inet static address 10.0.0.1 netmask 255.255.255.0 bridge_ports eth1
br0 has pretty much taken the place of
eth1 in the config. Also, we don't bridge in
wlan0 since our access point daemon will take care of that.
Along with this change in
/etc/network/interfaces, don't forget to also change your dnsmasq settings so that it listens on
br0 instead of
bridge-utils package if you haven't already and restart networking. Congrats, your router is now a one port network switch!
Since our inside interface is now
br0, we have to tweak our firewall rules a bit.
*nat :PREROUTING ACCEPT [0:0] :INPUT ACCEPT [0:0] :OUTPUT ACCEPT [0:0] :POSTROUTING ACCEPT [0:0] -A POSTROUTING -o eth0 -j MASQUERADE COMMIT *filter :INPUT DROP [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] -A INPUT -i lo -j ACCEPT -A INPUT -i eth1 -j ACCEPT -A INPUT -i br0 -j ACCEPT -A INPUT -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT -A INPUT -i eth0 -p icmp -m icmp --icmp-type 8 -j ACCEPT -A FORWARD -i eth0 -o br0 -m state --state RELATED,ESTABLISHED -j ACCEPT -A FORWARD -i br0 -o eth0 -j ACCEPT COMMIT
*filter :INPUT DROP [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] -A INPUT -i lo -j ACCEPT -A INPUT -i eth1 -j ACCEPT -A INPUT -i br0 -j ACCEPT COMMIT
hostapd, getting your wireless card running in AP mode is a cinch! It's just a package install away in most cases, and the configuration isn't too terrible. Below is my config, annotated to make it easier to understand.
# Set up some logging. VERY useful to see why things aren't working. logger_syslog=-1 logger_syslog_level=2 logger_stdout=-1 logger_stdout_level=2 # Which interface to use and which bridge to join interface=wlan0 bridge=br0 # Use this driver for AP stuff. This corresponds to the mac80211 driver # which most newer cards support. driver=nl80211 # 802.11 mode and channel, pretty self-explanatory hw_mode=g country_code=US channel=11 # Set and broadcast the SSID. Stupid double-negatives... ssid=test_net ignore_broadcast_ssid=0 # 802.11N stuff - Try 40 MHz channels, fall back to 20 MHz ieee80211n=1 ht_capab=[HT40-][SHORT-GI-20][SHORT-GI-40] # WPA Authentication auth_algs=1 # Open authentication, no WEP wpa=2 # WPA2 only, set to 3 for WPA+WPA2 wpa_passphrase=xxxxxxxxxxx # Hah! Like I'd put this in a gist. wpa_key_mgmt=WPA-PSK rsn_pairwise=CCMP # Cipher for WPA2 (AES in this case) # Don't use a MAC ACL macaddr_acl=0
The things to watch out for are the settings that are ORs of bits, like
wpa. When setting up your own AP, it's a good idea to check out the example config to see what each setting does and what the defaults are.
My config doesn't include any 5 GHz settings, so you'll have to figure those out on your own if you're lucky enough to have a card that supports it. If I get mine working, I'll make another post with those settings.
Once you're done with configuration, fire up
service hostpad start. If everything was successful, you should see
wlan0 bridged in (use the
brctl show command to check) and the network should be joinable by one of your wireless devices. If you don't see that, you'll want to check
/var/log/syslog to see what hostapd is complaining about.
And there you have it, a router with wireless! Next up is IPv6 support, so stay tuned for part 3.