WARNING This may work (because dhcp call disables dhcpcd). This will only work reliably if dhcpcd is disabled.
I too had a tough time with hidden networks and getting my RPi to connect, so much so I wrote/compiled a [edit: removed dead links, will re-upload when hosting issues are resolved] for not just connecting but also abtaining a second internal IP for more controll over what services where listening on what addresses.
The examples and comments of the previos answers are both ok however as you requested something with wpa_supplicant as well I figured I'd share.
The first above link leads to a self-signed https site where you can download full copies of any of the guides hosted; spicifficly it'll lead to a script I use to ensure remote access and other services get restarted when the RPi decides to stop reconizing the hidden access point that I use. I'll be including it within this post too in case self-signed warnings keep you from clicking.
The second link leads to where the guides are being backed-up/re-shared on a normal http web site; spicifficly it leads to the example of /etc/network/interfaces & /etc/wpa_supplicant/wpa_supplicant which will also be provided in this post in the second and third code blocks.
Script for ensuring your RPi reconnects to hidden network and updates a domain name host with external IP address just in case your RPi is connected to a dynamic ISP
#!/bin/bash
# Modify variables that contain yourwebsiteURL, yourSubdomain, yourToken, and username@emailaddress if you've a working mail server, then scroll to bottom of this script for usage instructions.
## Variables
savePath="/var/log"
extURL="yourwebsiteURL"
netInterface="wlan0"
DOMAIN="yourSubdomain"
dnsServerURL="http://$DOMAIN.duckdns.org"
TOKEN="yourToken"
updateDNSserverURL="https://www.duckdns.org/update?domains=$DOMAIN&token=$TOKEN&ip="
#emailAddress="username@emailaddress"
mkdir -p $savePath
echo "Save path : $savePath \n Logs will be saved there if enabled."
## Functions
## this function restarts network interface and updates DNS server if ping to your servers web page fails. Does nothing if ping sucseads.
UpdateDNSchecker (){
ping -s0.1 -c2 $extURL
if [ $? != 0 ]
then
date | tee -a /$savePathg/ipdown.log
echo "Restarted network services because - $extURL - not reachable." | tee -a $savePath/ipdown.log
ifdown --force $netInterface
ifup $netInterface
sleep 5
date | tee -a /$savePath/ipdown.log
echo "Sending update to - $dnsServerURL - incase public IP changed" | tee -a $savePath/ipdown.log
echo url=${updateDNSserverURL} | curl -k -o $savePath/duck.log -K -
echo "Your DNS server returned..." | tee -a $savePath/ipdown.log
cat $savePath/duck.log | tee -a $savePath/ipdown.log
# # Above updates duckdns.org name servers.
# # Bellow calls the fallowing defined functions.
# # Disable unwanted options with comment mark
# # This function is called at the very end of this script
RestartServices
roundOutlogs
#EmailResults
fi
}
## this function is called within UpdateDNSchecker above to restart ssh and other servers if ping failed
RestartServices (){
service ssh restart | tee -a $savePath/ipdown.log
service xrdp restart | tee -a $savePath/ipdown.log
}
## this function is called within UpdateDNSchecker above to save internal ips, ports and other useful networking information to logs
roundOutlogs (){
echo "The results of tracerout on $extURL are;" | tee -a $savePath/ipdown.log
traceroute $extURL | tee -a $savePath/ipdown.log
echo "The results of netstat -rn are;" | tee -a $savePath/ipdown.log
netstat -rn | tee -a $savePath/ipdown.log
echo "The results of netstat -nat are;" | tee -a $savePath/ipdown.log
netstat -nat | tee -a $savePath/ipdown.log
date | tee -a $savePath/ipdown.log
echo "### End of above log ###" | tee -a $savePath/ipdown.log
}
## this function is called within UpdateDNSchecker above to send logs out to the sys-admins email address.
EmailResults (){
## only enable if your server also has been setup for sending emails to external servers.
## or only enable if emailing to a server within your NAT that has been setup to recive email.
# echo "Server down and IP logs are in attached attachment." | mail -a $savePath/ipdown.log -s "Updated-IP-from-$extURL" $emailAddress > /dev/null
}
## end of functions now calling main function that will start this script
UpdateDNSchecker
### End of script ###
## Usage instructions
## # Copy this script to your /usr/local/sbin directory
## cp /wherever/you/downloaded/DNSupdater /usr/local/sbin/DNSupdater
## # Provide executable permissions to this script
## chmod +x /usr/local/sbin/DNSupdater
## # Edit your /etc/conetab file and add the following line to run this script every 5 minuets
## */5 * * * * root /usr/local/sbin/DNSupdater.sh 2>&1 > /dev/null
Contence of /etc/network/interfaces
auto lo
iface lo inet loopback
iface eth0 inet dhcp
allow-hotplug wlan0
iface wlan0 inet manual
wpa-roam /etc/wpa_supplicant/wpa_supplicant.conf
## ID strings
iface extnat1 inet static
address 192.168.1.50
netmask 255.255.255.0
network 192.168.1.0
broadcast 192.168.1.255
gateway 192.168.1.1
post-up ip addr add 192.168.1.51/24 brd + dev wlan0
# Above adds and bellow removes extra IP when interface on spicific network is available.
pre-down ip addr del 192.168.1.51/24 brd + dev wlan0
Contence of /etc/wpa_supplicant/wpa_supplicant
ctrl_interface=DIR=/var/run/wpa_supplicant GROUP=netdev
update_config=1
network={
ssid="yourNATid"
scan_ssid=1
psk="yourNATpasswd"
proto=RSN
key_mgmt=WPA-PSK
pairwise=CCMP
auth_alg=OPEN
id_str="extnat1"
}
In case you want to add a password protected WiFi network that is also hidden here's the proper way of placing the first few lins into wpa_supplicant.conf file.
wpa_passphrase "Your NATs SSID" "The Password" >> /etc/wpa_supplicant/wpa_supplicant.conf
I read that the network that you're trying to connect to is using something other than password; MAC address filtering? If so then they should consider adding password protection as an another layer of security because even an Android phone these days is capible of spoofing it's MAC address and most now are also capible of permiscious scanning of networks that they're not currently connected to; some require a bit more setup than others but the it is also posible with another RPi or PC to also exploit a network that is only using MAC address filtering and hidden network as it's security methods... of cource a WiFi password can also be cracked or leaked too so it's more about culling the hurd of would be exploiters. This is also why adding the passphrase as it's encrypted form is also suggested so that it doesn't leek easily when reconnecting; unlike stock Android phones; but that is why I run more than one network now, keeping the leekers on thier own password ;-)
Hope this added with the other examples already posted by others helps you out in maintaing your connections.
