Installed fresh 2020-02-13-raspbian-buster-full Did apt-get updates. I have a Pi connected to my Ethernet network behind a router connected to the Internet. I am running apps on the Pi that I can access from the local network. The Pi is a WiFi AP for clients. The WiFi clients can all access the internet and apps on the Pi. I cannot ping or access the WiFi clients from the Pi. Setup the following:
- hostapd
- dnsmasq
- net.ipv4.ip_forward=1
Create /etc/sysctl.d/routed-ap.conf
net.ipv4.ip_forward=1
Created /etc/dnsmasq.conf
interface=wlan1
dhcp-range=192.168.16.2,192.168.16.254,255.255.255.0,24h
domain=wlan
address=/gw.wlan/192.168.16.1
Create /etc/hostapd/hostapd.conf
interface=wlan1
driver=nl80211
ssid=NodeRed
hw_mode=g
channel=11
macaddr_acl=0
auth_algs=1
ignore_broadcast_ssid=0
wpa=2
wpa_passphrase=MySuperSecretPasscode
wpa_key_mgmt=WPA-PSK
#wpa_pairwise=TKIP
rsn_pairwise=CCMP
Edit the file /etc/default/hostapd
DAEMON_CONF="/etc/hostapd/hostapd.conf"
Some debug output:
rpi ~$ ifconfig
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 192.168.15.100 netmask 255.255.255.0 broadcast 192.168.15.255
lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536
inet 127.0.0.1 netmask 255.0.0.0
inet6 ::1 prefixlen 128 scopeid 0x10<host>
loop txqueuelen 1000 (Local Loopback)
wlan1: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 192.168.16.1 netmask 255.255.255.0 broadcast 192.168.16.255
rpi ~$ ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
link/ether b8:27:eb:4d:26:a6 brd ff:ff:ff:ff:ff:ff
inet 192.168.15.100/24 brd 192.168.15.255 scope global noprefixroute eth0
valid_lft forever preferred_lft forever
inet6 2605:e000:1703:826e:88e3:ac4d:9766:aed7/64 scope global dynamic mngtmpaddr noprefixroute
valid_lft 405885sec preferred_lft 405885sec
inet6 fe80::3572:c6ea:28ed:5eb7/64 scope link
valid_lft forever preferred_lft forever
3: wlan0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast state DOWN group default qlen 1000
link/ether b8:27:eb:18:73:f3 brd ff:ff:ff:ff:ff:ff
4: wlan1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
link/ether 9c:ef:d5:fe:80:c1 brd ff:ff:ff:ff:ff:ff
inet 192.168.16.1/24 brd 192.168.16.255 scope global noprefixroute wlan1
valid_lft forever preferred_lft forever
inet6 fe80::9f82:f9d8:d9c1:edd/64 scope link
valid_lft forever preferred_lft forever
rpi ~$ ip route
default via 192.168.15.1 dev eth0 src 192.168.15.100 metric 202
192.168.15.0/24 dev eth0 proto dhcp scope link src 192.168.15.100 metric 202
192.168.16.0/24 dev wlan1 proto dhcp scope link src 192.168.16.1 metric 304
rpi ~$ iptables --nat --list --verbose
Chain PREROUTING (policy ACCEPT 3149 packets, 512K bytes)
pkts bytes target prot opt in out source destination
Chain INPUT (policy ACCEPT 1938 packets, 171K bytes)
pkts bytes target prot opt in out source destination
Chain POSTROUTING (policy ACCEPT 9 packets, 1543 bytes)
pkts bytes target prot opt in out source destination
1589 371K MASQUERADE all -- any eth0 anywhere anywhere
Chain OUTPUT (policy ACCEPT 718 packets, 48585 bytes)
pkts bytes target prot opt in out source destination
Oops: Leaving post as it is (I think) the right way to setup an AP. Found out today that the Client was actually connecting to a different AP. It is an appliance so it was not obvious at the time. The clients were showing up in the leases file, because they had connected but just not currently connected.
ip addr,ip routeandsudo iptables --table nat --list --verbose.