Raspbian Buster - Keep network interface down on boot

Question

I am configuring my raspberry pi zero w for a project in which I am using a micro-USB Ethernet (eth0) and WiFi (wlan0) as network interfaces. I am using wpa_supplicant to configure wlan0 to connect to a wireless access point. For my specific application, it is critical that wlan0 is kept down on boot and does not make any connection with networks specified in wpa_supplicant.conf until a user connects and interacts through the console. (Running something like ifconfig wlan0 up to bring the interface online and then running wpa_supplicant to load the configuration file manually.) It is not sufficient to erase/rename wpa_supplicant.conf on shutdown as this must configuration must be able to withstand random reboots / power-cycling.

Things I have tried:

• I found that wpa_supplicant was a child process of systemd by default, so I tried modifying dhcpd to stop wpa_supplicant from starting on boot

• tried writing a systemd service to bring the interface down on boot (ifconfig down), but I am too inexperience with systemd to configure this correctly

• tried editing /etc/default/networking and adding the line EXCLUDE_INTERFACE=wlan0 to no effect (although this did strangely seem to delay the boot process)

Any ideas how I should go about configuring my pi in this manner? The ultimate goal is to ensure no outside wireless observer can see the pi until someone manually makes a wireless connection.

Answer 1

There a different ways you could achieve what you want.

Method 1 – use systemd-networkd

If you want to use systemd just follow step 1 and step 3 of this tutorial. Just omit this command systemctl enable wpa_supplicant@wlan0, so wpa_supplicant won't bring your interface up at boot. If you want to start it manually run sudo systemctl start [email protected].

Method 2 – use dhcpcd

The default way to manage network interfaces in raspbian is dhcpcd. I did not use this for a long time, but I guess if you add denyinterfaces wlan0 to /etc/dhcpcd.conf it won't bring up your interface either.

Then you can start it manually by running, but you have to make a config file without denyinterfaces wlan0:

wpa_supplicant -c/etc/wpa_supplicant/wpa_supplicant.conf -Dnl80211,wext -iwlan0
dhcpcd -f /etc/dhcpcd-wlan0.conf wlan0

Method 3 – disable dhcpcd

If wlan0 is the only interface you use, you could also disable dhcpcd.service and just run it when it's needed. To disable it run sudo systemctl disable dhcpcd.service. Then you can manually start it with sudo systemctl start dhcpcd.service.