I have been hunting the internet and using quite a few different guides to attempt to get an Access Point setup to work.
I am at a bit of a crossroads with my setup.
The main thing I am trying to achieve that is a bit different than most guides that I find is that I want my pfSense DHCP server to work for my WiFi as well. The DHCP seems to work, and I can get info to my Wireless Devices, but thats where it ends. Here is what I have done...
0. Basic Info
Firewall/Gateway/DHCP/DNS = 10.150.15.1 wlan0 = 10.150.25.2 eth0 = 10.150.15.3
1. Install the software
sudo apt-get install dnsmasq hostapd
2. Configure interface wlan0
interface wlan0 static ip_address=10.150.15.2/24
3. Configured Network Interfaces
allow-hotplug wlan0 iface wlan0 inet static address 10.150.15.2 netmask 255.255.255.0 # wpa-conf /etc/wpa_supplicant/wpa_supplicant.conf
4. Configure hostapd
interface=wlan0 driver=nl80211 ssid=ssid-name hw_mode=g channel=1 macaddr_acl=0 auth_algs=1 ignore_broadcast_ssid=0 wpa=2 wpa_key_mgmt=WPA-PSK wpa_passphrase=password rsn_pairwise=CCMP ieee80211n=1 wmm_enabled=1 ht_capab=[HT40][SHORT-GI-20][DISSS_CCK-40]
5. configure hostapd to find config file on boot
6. Configure dnsmasq (new file)
interface=wlan0 bind-interfaces server=10.150.15.1 domain-needed bogus-priv dhcp-relay=10.150.15.2,10.150.15.1
7. Setup ipv4 forwarding
8. nat setup
between eth0 and wlan0
iptables –t nat –A POSTROUTING –o eth0 –j MASQUERADE iptables –A FORWARD –i eth0 –o wlan0 –m state --state RELATED,ESTABLISHED –j ACCEPT iptables –A FORWARD -i wlan0 –o eth0 –j ACCEPT
9. Saved the iptables
Saved with the following command
sudo sh –c “iptables-save > /etc/iptables.ipv4.nat”
10. Made the iptables load on boot
/etc/rc.local (before exit 0)
iptables-restore < /etc/iptables.ipv4.nat
My thoughts are that in step 10 i have seen many people load the iptables in different ways, however this DOES load them, so i dont think this is the issue.
My hostapd file looks similar to many others on the net using a Rpi3, however i have seen people use wpa_pairwise=CCMP and even wpa_pairwise=TKIP However after doing some reading i can see TKIP is not safe, and in general the rsn_pairwise=CCMP is the better pick.
My dnsmasq file is where i am mostly unsure of what to do. As stated previously everyone is making the AP their DHCP, but this is not ideal for me as i do run a local ESXi server, and i like the pfSense firewall managing the different network's DHCP/DNS services. Using the dnsmasq dhcp-relay feature seems to be the best choice. Though proper setup here is a little hazy to me as I have never really toyed with dnsmasq directly (though it is in pfsense running behind the gui).
At this point I can see the WiFi SSID, I can connect, and i get a DHCP response with address, gateway, dns info, but I can not ping anything, nor do i get internet.
Upon executing the following command i get some info on the initialization of the hostapd config.
CMD: sudo /usr/sbin/hostapd /etc/hostapd/hostapd.conf Configuration file: /etc/hostapd/hostapde.conf Failed to create interface mon.wlan0: -95 (Operation not supported) wlan0: Could not connect to kernel driver Using interface wlan with hwaddr >MAC ADDRESS< and ssid "name" wlan0: interface stat UNINITIALIZED->ENABLED wlan0: AP-ENABLED