Wifi access point works but not when roaming between networks of the same SSID

Question

I've been searching a while for an answer to this but I can't find the solution and my problem is quite specific.

Basically I want to create an additional and seamless WiFi access point on my Raspberry PI (2 with WiFi dongle). I have setup hostapd and dnsmasq services as below and they work perfectly if a client manually connects directly to my PI. However if a client, which is initially connected to the WiFi of my main router, goes out of WiFi range of my main router the client will correctly switch to the access point on my Raspberry PI (it has an identical SSID as my main router) but it then loses internet connectivity because it doesn't accept the IP address supplied by the dnsmasq service on the Raspberry PI.

How can I force clients to re-negotiate the IP address with the new access point it switched to? I'm only assuming that is the problem of the lost connectivity because on the client I can see it is connected to my RPI access point but it has the wrong IP address. It might be a routing problem instead but I don't know.

I cannot use bridging unfortunately because later I want to be able to add a guest WiFi access point using a virtual interface. I've tried that and it works except again for the roaming problem described above.

Hopefully I've made myself clear and provided enough information.

hostapd.conf:

interface=wlan0
driver=nl80211
ssid=Hawthorne-Test
hw_mode=g
channel=11
macaddr_acl=0
auth_algs=1
ignore_broadcast_ssid=0
wpa=2
wpa_passphrase=<MASKED OUT>
wpa_key_mgmt=WPA-PSK
wpa_pairwise=CCMP
rsn_pairwise=CCMP
ieee80211n=1
ht_capab=[HT40][SHORT-GI-20]
wmm_enabled=1

dnsmasq.conf:

interface=wlan0
listen-address=192.168.34.1
bind-interfaces
server=192.168.1.1
bogus-priv
dhcp-range=interface:wlan0,192.168.34.50,192.168.34.150,24h
dhcp-option=wlan0,6,192.168.1.1

Answer 1

I think you need to set the DHCP server to authoritative mode by adding: dhcp-authoritative to the dnsmasq.conf file.

In this mode it will barge in and take over the lease for any client which broadcasts on the network. This avoids long timeouts when a machine wakes up on a new network.

Answer 2

While I haven't solved the problem of roaming between NATted wifi networks, I've worked around the problem by using a combination of VLANs and bridging. The reason I thought I couldn't use bridging was because of the need to specify firewall rules on just the wireless part of the bridge and also because I thought my wireless devices didn't support that but it turns out they do. However by creating a virtual interface with a VLAN tag and bridging that with the wireless AP, I'm able to specify the iptables rules needed to create a guest network to include physical ports as well as a guest wifi network. Multiple guest APs can now use the same DHCP server (dnsmasq) and are completely separate (as far as I can tell) from my main LAN despite using the same ports and wireless devices. The only very minor downside is that the Raspberry PI 3 wireless chipset doesn't support virtual interfaces but I've overcome this with a £5 wireless dongle which does.

So on the Raspberry PI acting as the router, firewall and wifi access point for the guest network I'm using the following packages:

• vlan - create a virtual interface to allow the PI to be on both the main LAN (with the internet) and the guest LAN.
• bridge-utils - to bridge the guest vlan with the wireless AP.
• hostapd - to create the guest AP.
• dnsmasq - DHCP server for the guest network only (tied to the guest bridge interface).
• iptables (not a package but essential configuration) - provides internet for the guest network while at the same time ensuring guests cannot access anything else on the network.

Performance is perfectly adequate for a guest network which will only be used occasionally (~20mbps download and upload).