How to set up Alpine as a wireless router

From Alpine Linux

Pi Zero W Wireless Router

This page describes building a Wireless Access Point with two wired ethernet ports for building a home router that connects to the internet with one wired port, and an internal LAN with the second wired port and the on-board WiFi.

The intent is to provide this:

                                    |<-->eth1 <-->| 
Internet <--> eth0 <-->FireWall<-->br0           Internal<--> ssh,bind,dhcp, with ssh reverse ssh connections.
                                    |<-->wlan0<-->|

Overview

I generally run Debian and when forced by Red Hot Irons, Red Hat. This is my first foray into Alpine. So far I am very impressed. I mirrored the 3.12 armhf repos so I had things local when I needed them. Word to the wise, it comprises 13 GB of apk files.
One *really* nice feature of Alpine is apk, the yum/apt replacement:

  • It is simple and to the point.
  • The same tool provides *repo* level dependency reporting!
  • Install of single packages without repo signing (I never did get the signing correct, but I can install).

Prepare

  • Obtain a microSD card (or HDD) you can wipe the data from. We will assume it is /dev/sdc.
  • Make a 256M FAT16 partition (sudo mkfs.vfat -n ALPBOOT /dev/sdc1)
  • The rest of the device can be ext2 (ext3/4 on HDD) (sudo mke2fs -m1 -L alext3 /dev/sdc2).
  • Untar the alpine-rpi-3.12.3-armhf.tar.gz and copy all of the files to the fat16 partition which can be as large as 2G.
  • Make sure you have all the packages from the package list below installed on the SD card. This will save you lots of time.
  • Add this to usercfg.txt at the root of the FAT16 partition:
 enable_uart=1
 gpu_mem=16
 dtparam=audio=off
  • This is the contents of cmdline.txt:
 modules=loop,squashfs,sd-mod,usb-storage console=tty1 console=ttyAMA0,115200

First Boot

  • Put the SD into the pi zero
  • Connect the serial port
  • Run minicom with the parameters set to 115200,n,8,1, no flow control.
  • Power up the Pi.

Copy Root

  • mkdir /stage
  • mount /dev/sda2 /stage
  • for d in $(ls -1 /|grep -v 'media\|stage\|dev\|proc\|sys'); do cp -a /$d /stage; done
  • modules are loop mounted to /.modloop, and lib/modules is symlinked to that, so
  • rm /stage/lib/modules
  • cp -a /.modloop /stage/lib/modules
  • Fix cmdline.txt
 mount -o remount,rw /media/mmcblk0p1
 echo 'root=/dev/mmcblk0p2' >> /media/mmcblk0p1/cmdline.txt
  • reboot

Install

  • verify you are now operating from the ext2 filesystem where you copied the rootfs.
  • install openssh, openssh-server, openssh-client, openssh-server-common,
  • install dnsmasq, ethtool, hostapd*, busybox extras, iptables*, iw,net-tools, tree, wireless-tools.
  • edit all the configurations supplied here.
ssh config

The allowed users are not normal names since I want the names to be a little obfuscated. Not that it really matters, since this is a key driven setup
AddressFamily inet
ListenAddress 0.0.0.0
HostKey /etc/ssh/ssh_host_rsa_key
LogLevel INFO
LoginGraceTime 30
PermitRootLogin no
StrictModes yes
AllowUsers Som123X Extern4524User
PubkeyAuthentication yes
AuthorizedKeysFile /etc/ssh/authorized_keys
HostbasedAuthentication yes
IgnoreUserKnownHosts yes
IgnoreRhosts yes
PasswordAuthentication no
ChallengeResponseAuthentication no
AllowTcpForwarding yes
GatewayPorts yes
X11Forwarding no


dnsmasq.conf

/etc/dnsmasq.conf
This has two subnets. One for normal dhcp, the other for pseudo static - dhcp provided by MAC. One example here.
interface=br0
except-interface=eth0
dhcp-range=subnet0,192.168.0.10,192.168.0.100,255.255.255.0,24h
dhcp-range=subnet1,192.168.0.4,192.168.0.6,255.255.255.0,24h
bind-interfaces

  1. log-queries
  2. log-dhcp

dhcp-host=70:85:66:c4:48:55,192.168.0.4,nas

/etc/hosts

dnsmasq provides DNS answers from the hosts file. Nice.
127.0.0.1 localhost localhost.localdomain

1 localhost localhost.localdomain

192.168.0.3 wireless
192.168.0.4 nas
192.168.0.5 mpd

hostapd.conf

/etc/hostapd/hostapd.conf
interface=wlan0
bridge=br0
hw_mode=g
channel=7
wmm_enabled=0
macaddr_acl=0
auth_algs=1
ignore_broadcast_ssid=0
wpa=2
wpa_key_mgmt=WPA-PSK
wpa_pairwise=TKIP
rsn_pairwise=CCMP
ssid=Whatever
wpa_passphrase=YouMakeItUp

interfaces

/etc/network/interfaces
auto lo
iface lo inet loopback

auto eth0
iface eth0 inet dhcp

       hostname ANYNAME

       hwaddress ether FE:ED:BE:EF:33:DD


iface eth1 inet manual
iface wlan0 inet manual

auto br0
iface br0 inet static

       pre-up ifconfig eth1 up

       bridge-ports eth1 wlan0

       bridge-stp off

       address 192.168.0.3

       broadcaset 192.168.1.255

       netmask 255.255.255.0
Permissive iptables

Do NOT use this connected to the internet! There is NO protection.
This is my stopopen in my replacement iptables
iptables -P INPUT ACCEPT
< iptables -F INPUT
iptables -P OUTPUT ACCEPT
iptables -F OUTPUT
iptables -P FORWARD ACCEPT
iptables -F FORWARD
iptables -F -t nat
iptables -F

References

apk notes:

  • Create, index and check dependencies on a list of apk files: apk index -o APKINDEX.unsigned.tar.gz *.apk
  • Install a package: apk add iw OR apk add /path/to/iw-5.4-r0.apk
  • remove a package: apk del iw
  • repository lists are in: /etc/apk/repositories
 * Local URL: /media/mmcblk0p1/apks
 * Remote URL: http://dl-cdn.alpinelinux.org/alpine/v3.12/main

FAT16/32 limits
udhcpc
ez-ipupdate
Dynamic_DNS
Alpine Linux Bridge
Connect to wireless AP
dnsmasq listen restrictions
Disable IPV6
dnsmasq Docs
HostApd Docs
[rsync://rsync.alpinelinux.org/alpine Alpine Repos]
Set Static DNS names
Reverse SSH tunnel

Pi Specific

Pi Wifi Repeater
WiFi Bridge
Alpine Install
Classic Sys Install on Pi

Not Related, but Interesting

AP and Managed Mode
AP and MQTT

Package List

Put these in the apks/armhf directory on the 256M Fat partition:

iptables-1.8.4-r2.apk openssh-8.3_p1-r1.apk iptables-openrc-1.8.4-r2.apk openssh-client-8.3_p1-r1.apk abuild-3.6.0-r1.apk iw-5.4-r0.apk openssh-keygen-8.3_p1-r1.apk alpine-base-3.12.3-r0.apk kbd-bkeymaps-2.2.0-r2.apk openssh-server-8.3_p1-r1.apk alpine-baselayout-3.2.0-r7.apk libacl-2.2.53-r0.apk openssh-server-common-8.3_p1-r1.apk alpine-conf-3.9.0-r1.apk libattr-2.4.48-r0.apk openssh-sftp-server-8.3_p1-r1.apk alpine-keys-2.2-r0.apk libblkid-2.35.2-r0.apk openssl-1.1.1i-r0.apk alpine-mirrors-3.5.10-r0.apk libc-utils-0.7.2-r3.apk patch-2.7.6-r6.apk apk-tools-2.10.5-r1.apk libcap-2.27-r0.apk pcsc-lite-libs-1.8.26-r0.apk attr-2.4.48-r0.apk libcom_err-1.45.6-r0.apk pkgconf-1.7.2-r0.apk bash-5.0.17-r0.apk libcrypto1.1-1.1.1i-r0.apk ppp-atm-2.4.8-r2.apk bash-completion-2.10-r0.apk libcurl-7.69.1-r3.apk ppp-chat-2.4.8-r2.apk bonding-2.6-r4.apk libedit-20191231.3.1-r0.apk ppp-daemon-2.4.8-r2.apk bridge-1.5-r4.apk libev-4.33-r0.apk ppp-l2tp-2.4.8-r2.apk bridge-utils-1.6-r0.apk libgcc-9.3.0-r2.apk ppp-minconn-2.4.8-r2.apk busybox-1.31.1-r19.apk libmnl-1.0.4-r0.apk ppp-passprompt-2.4.8-r2.apk busybox-extras-1.31.1-r19.apk libnftnl-1.1.6-r0.apk ppp-passwordfd-2.4.8-r2.apk busybox-initscripts-3.2-r2.apk libnftnl-libs-1.1.6-r0.apk ppp-pppoe-2.4.8-r2.apk busybox-suid-1.31.1-r19.apk libnl3-3.5.0-r0.apk ppp-radius-2.4.8-r2.apk c-ares-1.16.1-r0.apk libpcap-1.9.1-r2.apk ppp-winbind-2.4.8-r2.apk ca-certificates-20191127-r4.apk libssl1.1-1.1.1i-r0.apk readline-8.0.4-r0.apk ca-certificates-bundle-20191127-r4.apk libstdc++-9.3.0-r2.apk scanelf-1.2.6-r0.apk chrony-3.5.1-r0.apk libtls-standalone-2.9.1-r1.apk signature.tar.gz chrony-openrc-3.5.1-r0.apk libusb-1.0.23-r0.apk ssl_client-1.31.1-r19.apk curl-7.69.1-r3.apk libuuid-2.35.2-r0.apk tar-1.32-r1.apk dbus-libs-1.12.18-r0.apk lzip-1.21-r0.apk tcpdump-4.9.3-r2.apk dnsmasq-2.81-r0.apk mii-tool-1.60_git20140218-r2.apk tree-1.8.0-r0.apk e2fsprogs-1.45.6-r0.apk musl-1.1.24-r10.apk tzdata-2020c-r1.apk e2fsprogs-libs-1.45.6-r0.apk musl-utils-1.1.24-r10.apk usb-modeswitch-2.6.0-r1.apk ethtool-5.6-r0.apk ncurses-libs-6.2_p20200523-r0.apk vlan-2.2-r0.apk ez-ipupdate-3.0.10-r9.apk ncurses-terminfo-base-6.2_p20200523-r0.apk wireless-tools-30_pre9-r1.apk fakeroot-1.24-r0.apk net-tools-1.60_git20140218-r2.apk wpa_supplicant-2.9-r5.apk haveged-1.9.8-r1.apk network-extras-1.2-r0.apk wpa_supplicant-openrc-2.9-r5.apk haveged-openrc-1.9.8-r1.apk nghttp2-1.41.0-r0.apk zlib-1.2.11-r3.apk hostapd-2.9-r2.apk nghttp2-libs-1.41.0-r0.apk hostapd-openrc-2.9-r2.apk openrc-0.42.1-r11.apk

Retrieved from "https://wiki.alpinelinux.org/w/index.php?title=How_to_set_up_Alpine_as_a_wireless_router&oldid=22087"