2

I have been hunting the internet and using quite a few different guides to attempt to get an Access Point setup to work.

I am at a bit of a crossroads with my setup.

The main thing I am trying to achieve that is a bit different than most guides that I find is that I want my pfSense DHCP server to work for my WiFi as well. The DHCP seems to work, and I can get info to my Wireless Devices, but thats where it ends. Here is what I have done...

0. Basic Info

Firewall/Gateway/DHCP/DNS = 10.150.15.1
wlan0 = 10.150.25.2
eth0 = 10.150.15.3

1. Install the software

Basic software

sudo apt-get install dnsmasq hostapd

2. Configure interface wlan0

/etc/dhcpcd.conf

interface wlan0
static ip_address=10.150.15.2/24

3. Configured Network Interfaces

/etc/network/interfaces

allow-hotplug wlan0
iface wlan0 inet static
address 10.150.15.2
netmask 255.255.255.0
#    wpa-conf /etc/wpa_supplicant/wpa_supplicant.conf

4. Configure hostapd

/etc/hostapd/hostapd.conf

interface=wlan0
driver=nl80211
ssid=ssid-name
hw_mode=g
channel=1
macaddr_acl=0
auth_algs=1
ignore_broadcast_ssid=0
wpa=2
wpa_key_mgmt=WPA-PSK
wpa_passphrase=password
rsn_pairwise=CCMP
ieee80211n=1
wmm_enabled=1
ht_capab=[HT40][SHORT-GI-20][DISSS_CCK-40]

5. configure hostapd to find config file on boot

/etc/default/hostapd

DAEMON_CONF=”/etc/hostapd/hostapd.conf”

6. Configure dnsmasq (new file)

/etc/dnsmasq.conf

interface=wlan0
bind-interfaces
server=10.150.15.1
domain-needed
bogus-priv
dhcp-relay=10.150.15.2,10.150.15.1

7. Setup ipv4 forwarding

/etc/sysctl.conf

net.ipv4.ip_forward=1

8. nat setup

between eth0 and wlan0

iptables –t nat –A POSTROUTING –o eth0 –j MASQUERADE
iptables –A FORWARD –i eth0 –o wlan0 –m state --state RELATED,ESTABLISHED –j ACCEPT
iptables –A FORWARD -i wlan0 –o eth0 –j ACCEPT

9. Saved the iptables

Saved with the following command

sudo sh –c “iptables-save > /etc/iptables.ipv4.nat”

10. Made the iptables load on boot

/etc/rc.local (before exit 0)

iptables-restore < /etc/iptables.ipv4.nat

Thoughts...

My thoughts are that in step 10 i have seen many people load the iptables in different ways, however this DOES load them, so i dont think this is the issue.

My hostapd file looks similar to many others on the net using a Rpi3, however i have seen people use wpa_pairwise=CCMP and even wpa_pairwise=TKIP However after doing some reading i can see TKIP is not safe, and in general the rsn_pairwise=CCMP is the better pick.

My dnsmasq file is where i am mostly unsure of what to do. As stated previously everyone is making the AP their DHCP, but this is not ideal for me as i do run a local ESXi server, and i like the pfSense firewall managing the different network's DHCP/DNS services. Using the dnsmasq dhcp-relay feature seems to be the best choice. Though proper setup here is a little hazy to me as I have never really toyed with dnsmasq directly (though it is in pfsense running behind the gui).

At this point I can see the WiFi SSID, I can connect, and i get a DHCP response with address, gateway, dns info, but I can not ping anything, nor do i get internet.

Errors?

Upon executing the following command i get some info on the initialization of the hostapd config.

CMD: sudo /usr/sbin/hostapd /etc/hostapd/hostapd.conf

Configuration file: /etc/hostapd/hostapde.conf
Failed to create interface mon.wlan0: -95 (Operation not supported)
wlan0: Could not connect to kernel driver
Using interface wlan with hwaddr >MAC ADDRESS< and ssid "name"
wlan0: interface stat UNINITIALIZED->ENABLED
wlan0: AP-ENABLED
  • Can no one help?? – Andreas Aug 16 '16 at 14:12
  • I feel this is a problem with packet forwarding. I have tried so many guides bit by bit and its just not working. Someone PLEASE save the day!! – Andreas Aug 19 '16 at 10:46
  • wlan0 = 10.150.15.2 eth0 = 10.150.15.3. You can not have two network interfaces on the same subnet and expect things to work (at least without having them bridged, but that doesn't appear the case here). Both interfaces must be on separate networks (subnets, prefixes whichever you prefer) in order to have packets route properly. That may not be the only one, but it's the most glaring. – stevieb Sep 2 '16 at 15:37
  • Aha! A voice of reason :) actually I put this project down for a bit because of lack of progress. But that actually makes a lot of sense. Ideally I think that with what I am wanting I would most likely want them bridged yes? I could see if the wlan0 had a different address that I would then need/want a separate DHCP server for the WiFi, but that is not what I want to achieve. I would like the pfSense DHCP server to be the one in use for my wifi. So I do just need a bridged interface. Or what do you think Stevieb? – Andreas Sep 2 '16 at 15:50
  • If you put both interfaces in separate networks, you can configure a DHCP Relay (research dhcrelay... I've never used DHCP relay on *nix, only Cisco/Juniper) to forward DHCP requests from one network to the DHCP server in the other, allowing you to have a single DHCP server for both networks. Both bridging and routing have their benefits/drawbacks. I personally would route, as that creates separation between the wired network and wireless, and makes firewall rules much more distinctive. – stevieb Sep 2 '16 at 15:54
1
Firewall/Gateway/DHCP/DNS = 10.150.15.1
wlan0 = 10.150.15.2
eth0 = 10.150.15.3

Unless you're bridging interfaces (which you don't appear to be), you must have each network interface within it's own network prefix (subnet), or else the device won't know how to route packets.

So if you change your wlan0 to 10.150.20.0/24 instead of 10.150.15.0/24, that'll at least be a start.

You will need to add a route in the pfSense gateway so it knows how to get to the new wifi network (route 10.150.20.0/24 to 10.150.15.3). You'll also have to point the wifi clients to the new wifi IP on the Pi as their gateway (eg. 10.150.20.1)

You'll then want to configure your Pi to be a DHCP relay (dhcrelay) to forward DHCP requests over to the DHCP server on the non-wifi network to provide the ability to have the server serve up addresses to both networks.

That will also require you to set up a new DHCP scope for this new wifi subnet as well.

I'm not versed in iptables, but the config does look reasonably sane at an unexperienced glance, but some rejigging may be necessary.

Your forwarding setup looks correct, so hopefully this'll be all you need.

You may consider ignoring the DHCP relaying until you at least get to the point you can route traffic using static IPs between the two networks (ie. wifi device behind the Pi can at least ping (successfully) the inside interface of the pfSense box).

0

I followed more or less the same steps as yours using the tutorial here.

My problem was at the nat setup step (IPv4 forwarding), you need to make sure that the forwarding interface (eth0 in your case) is working properly, meaning that it is connected to the internet, before writing the iptables statements to create the iptables.nat file. I also found out that I couldn't just modify the saved iptables.nat after it was created: the statements needed to be run first before

sudo sh –c “iptables-save > /etc/iptables.ipv4.nat”

protected by Community Jan 10 '17 at 11:57

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.