Rpi3 Access Point/Hotspot Connects but no Internet

Question

I have been hunting the internet and using quite a few different guides to attempt to get an Access Point setup to work.

I am at a bit of a crossroads with my setup.

The main thing I am trying to achieve that is a bit different than most guides that I find is that I want my pfSense DHCP server to work for my WiFi as well. The DHCP seems to work, and I can get info to my Wireless Devices, but thats where it ends. Here is what I have done...

0. Basic Info

Firewall/Gateway/DHCP/DNS = 10.150.15.1
wlan0 = 10.150.25.2
eth0 = 10.150.15.3

1. Install the software

Basic software

sudo apt-get install dnsmasq hostapd

2. Configure interface wlan0

/etc/dhcpcd.conf

interface wlan0
static ip_address=10.150.15.2/24

3. Configured Network Interfaces

/etc/network/interfaces

allow-hotplug wlan0
iface wlan0 inet static
address 10.150.15.2
netmask 255.255.255.0
#    wpa-conf /etc/wpa_supplicant/wpa_supplicant.conf

4. Configure hostapd

/etc/hostapd/hostapd.conf

interface=wlan0
driver=nl80211
ssid=ssid-name
hw_mode=g
channel=1
macaddr_acl=0
auth_algs=1
ignore_broadcast_ssid=0
wpa=2
wpa_key_mgmt=WPA-PSK
wpa_passphrase=password
rsn_pairwise=CCMP
ieee80211n=1
wmm_enabled=1
ht_capab=[HT40][SHORT-GI-20][DISSS_CCK-40]

5. configure hostapd to find config file on boot

/etc/default/hostapd

DAEMON_CONF=”/etc/hostapd/hostapd.conf”

6. Configure dnsmasq (new file)

/etc/dnsmasq.conf

interface=wlan0
bind-interfaces
server=10.150.15.1
domain-needed
bogus-priv
dhcp-relay=10.150.15.2,10.150.15.1

7. Setup ipv4 forwarding

/etc/sysctl.conf

net.ipv4.ip_forward=1

8. nat setup

between eth0 and wlan0

iptables –t nat –A POSTROUTING –o eth0 –j MASQUERADE
iptables –A FORWARD –i eth0 –o wlan0 –m state --state RELATED,ESTABLISHED –j ACCEPT
iptables –A FORWARD -i wlan0 –o eth0 –j ACCEPT

9. Saved the iptables

Saved with the following command

sudo sh –c “iptables-save > /etc/iptables.ipv4.nat”

10. Made the iptables load on boot

/etc/rc.local (before exit 0)

iptables-restore < /etc/iptables.ipv4.nat

Thoughts...

My thoughts are that in step 10 i have seen many people load the iptables in different ways, however this DOES load them, so i dont think this is the issue.

My hostapd file looks similar to many others on the net using a Rpi3, however i have seen people use wpa_pairwise=CCMP and even wpa_pairwise=TKIP However after doing some reading i can see TKIP is not safe, and in general the rsn_pairwise=CCMP is the better pick.

My dnsmasq file is where i am mostly unsure of what to do. As stated previously everyone is making the AP their DHCP, but this is not ideal for me as i do run a local ESXi server, and i like the pfSense firewall managing the different network's DHCP/DNS services. Using the dnsmasq dhcp-relay feature seems to be the best choice. Though proper setup here is a little hazy to me as I have never really toyed with dnsmasq directly (though it is in pfsense running behind the gui).

At this point I can see the WiFi SSID, I can connect, and i get a DHCP response with address, gateway, dns info, but I can not ping anything, nor do i get internet.

Errors?

Upon executing the following command i get some info on the initialization of the hostapd config.

CMD: sudo /usr/sbin/hostapd /etc/hostapd/hostapd.conf

Configuration file: /etc/hostapd/hostapde.conf
Failed to create interface mon.wlan0: -95 (Operation not supported)
wlan0: Could not connect to kernel driver
Using interface wlan with hwaddr >MAC ADDRESS< and ssid "name"
wlan0: interface stat UNINITIALIZED->ENABLED
wlan0: AP-ENABLED

Answer 1

Firewall/Gateway/DHCP/DNS = 10.150.15.1
wlan0 = 10.150.15.2
eth0 = 10.150.15.3

Unless you're bridging interfaces (which you don't appear to be), you must have each network interface within it's own network prefix (subnet), or else the device won't know how to route packets.

So if you change your wlan0 to 10.150.20.0/24 instead of 10.150.15.0/24, that'll at least be a start.

You will need to add a route in the pfSense gateway so it knows how to get to the new wifi network (route 10.150.20.0/24 to 10.150.15.3). You'll also have to point the wifi clients to the new wifi IP on the Pi as their gateway (eg. 10.150.20.1)

You'll then want to configure your Pi to be a DHCP relay (dhcrelay) to forward DHCP requests over to the DHCP server on the non-wifi network to provide the ability to have the server serve up addresses to both networks.

That will also require you to set up a new DHCP scope for this new wifi subnet as well.

I'm not versed in iptables, but the config does look reasonably sane at an unexperienced glance, but some rejigging may be necessary.

Your forwarding setup looks correct, so hopefully this'll be all you need.

You may consider ignoring the DHCP relaying until you at least get to the point you can route traffic using static IPs between the two networks (ie. wifi device behind the Pi can at least ping (successfully) the inside interface of the pfSense box).

Answer 2

I followed more or less the same steps as yours using the tutorial here.

My problem was at the nat setup step (IPv4 forwarding), you need to make sure that the forwarding interface (eth0 in your case) is working properly, meaning that it is connected to the internet, before writing the iptables statements to create the iptables.nat file. I also found out that I couldn't just modify the saved iptables.nat after it was created: the statements needed to be run first before

sudo sh –c “iptables-save > /etc/iptables.ipv4.nat”