Recently my home AP took a massive plunge when a cat knocked it over, and long story short, we just had a baby and my money is going towards what we need for the little man. At this point I decided to use a Rpi3 with Raspibian Jessie Distro. It is fully updated, expanded, timezone set and kernel updated. I have been hunting the internet and using quite a few different guides to attempt to get an Access Point setup to work. 

I am at a bit of a crossroads with my setup. 

The main thing I am trying to achieve that is a bit different than most guides that I find is that I want my pfSense DHCP server to work for my WiFi as well. The DHCP seems to work, and I can get info to my Wireless Devices, but thats where it ends. Here is what I have done...

Firewall/Gateway/DHCP/DNS = 10.150.15.1

wlan0 = 10.150.15.2

eth0 = 10.150.15.3

1. Install the software

Basic software
	
	sudo apt-get install dnsmasq hostapd

2. Configure interface wlan0

/etc/dhcpcd.conf 


    interface wlan0
    static ip_address=10.150.15.2/24

3. Configured Network Interfaces

/etc/network/interfaces
 
	allow-hotplug wlan0
	iface wlan0 inet static
	address 10.150.15.2
    netmask 255.255.255.0
    #    wpa-conf /etc/wpa_supplicant/wpa_supplicant.conf


4. Configure hostapd

/etc/hostapd/hostapd.conf

	interface=wlan0
	driver=nl80211
	ssid=ssid-name
	hw_mode=g
	channel=1
	macaddr_acl=0
	auth_algs=1
	ignore_broadcast_ssid=0
	wpa=2
	wpa_key_mgmt=WPA-PSK
	wpa_passphrase=password
	rsn_pairwise=CCMP
	ieee80211n=1
	wmm_enabled=1
    ht_capab=[HT40][SHORT-GI-20][DISSS_CCK-40]

5. configure hostapd to find config file on boot

/etc/default/hostapd

    DAEMON_CONF=”/etc/hostapd/hostapd.conf”

6. Configure dnsmasq (new file)

/etc/dnsmasq.conf

	interface=wlan0
	bind-interfaces
	server=10.150.15.1
	domain-needed
	bogus-priv
	dhcp-relay=10.150.15.2,10.150.15.1

7. Setup ipv4 forwarding

/etc/sysctl.conf

    net.ipv4.ip_forward=1

8. nat setup 

between eth0 and wlan0

	iptables –t nat –A POSTROUTING –o eth0 –j MASQUERADE
	iptables –A FORWARD –i eth0 –o wlan0 –m state --state RELATED,ESTABLISHED –j ACCEPT
	iptables –A FORWARD -i wlan0 –o eth0 –j ACCEPT

9. Saved the iptables

Saved with the following command

	sudo sh –c “iptables-save > /etc/iptables.ipv4.nat”

10. Made the iptables load on boot

/etc/rc.local (before exit 0)

	iptables-restore < /etc/iptables.ipv4.nat


My thoughts are that in step 10 i have seen many people load the iptables in different ways, however this DOES load them, so i dont think this is the issue.

My hostapd file looks similar to many others on the net using a Rpi3, however i have seen people use wpa_pairwise=CCMP and even wpa_pairwise=TKIP   However after doing some reading i can see TKIP is not safe, and in general the rsn_pairwise=CCMP is the better pick.

My dnsmasq file is where i am mostly unsure of what to do. As stated previously everyone is making the AP their DHCP, but this is not ideal for me as i do run a local ESXi server, and i like the pfSense firewall managing the different network's DHCP/DNS services. Using the dnsmasq dhcp-relay feature seems to be the best choice. Though proper setup here is a little hazy to me as I have never really toyed with dnsmasq directly (though it is in pfsense running behind the gui). 

At this point I can see the WiFi SSID, I can connect, and i get a DHCP response with address, gateway, dns info, but I can not ping anything, nor do i get internet.