How to setup a wireless access point
This material is work-in-progress ...
Do not follow instructions here until this notice is removed.
Install needed packages
Check that card is detected
Cat /proc/net/dev and see which cards are detected. If no cards are available, check what driver the card uses and modprobe it. Check that the card is in master mode.
This document describes how to configure a network bridge interface in Alpine Linux.
Bridges are manually managed with the brctl command.
Usage: brctl COMMAND [BRIDGE [INTERFACE]] Manage ethernet bridges Commands: show Show a list of bridges addbr BRIDGE Create BRIDGE delbr BRIDGE Delete BRIDGE addif BRIDGE IFACE Add IFACE to BRIDGE delif BRIDGE IFACE Delete IFACE from BRIDGE setageing BRIDGE TIME Set ageing time setfd BRIDGE TIME Set bridge forward delay sethello BRIDGE TIME Set hello time setmaxage BRIDGE TIME Set max message age setpathcost BRIDGE COST Set path cost setportprio BRIDGE PRIO Set port priority setbridgeprio BRIDGE PRIO Set bridge priority stp BRIDGE [1|0] STP on/off
To manually create a bridge interface br0:
To add interface eth0 and eth1 to the bridge br0:
Note that you need to set the link status to up on the added interfaces.
Install the scripts that configures the bridge.
Bridging is then configured in /etc/network/interfaces with the bridge-ports keyword. Note that you normally don't assign ip addresses to the bridged interfaces (eth0 and eth1 in our example) but to the bridge itself (br0).
In this example the address 192.168.0.1/24 is used.
auto br0 iface br0 inet static bridge-ports eth0 eth1 bridge-stp 0 address 192.168.0.1 netmask 255.255.255.0
You can set the various options with those keywords:
- Set bridge ports (ethX) or none for no physical interfaces
- Set ageing time
- Set bridge forward delay
- Set hello time
- Set bridge max message age
- Set path cost
- Set port priority
- Set bridge priority
- STP on/off
For older versions of Alpine Linux, or if you want be able to control the bridge interfaces individually, you need to use pre-up/post-down hooks.
auto br0 iface br0 inet static pre-up brctl addbr br0 pre-up echo 0 > /proc/sys/net/bridge/bridge-nf-call-arptables pre-up echo 0 > /proc/sys/net/bridge/bridge-nf-call-iptables pre-up echo 0 > /proc/sys/net/bridge/bridge-nf-call-ip6tables address 192.168.0.253 netmask 255.255.255.0 gateway 192.168.0.254 post-down brctl delbr br0 auto eth0 iface eth0 inet manual up ip link set $IFACE up up brctl addif br0 $IFACE down brctl delif br0 $IFACE || true down ip link set $IFACE down auto eth1 iface eth1 inet manual up ip link set $IFACE up up brctl addif br0 $IFACE down brctl delif br0 $IFACE || true down ip link set $IFACE down
That way you create br0 with: ifup br0, and you can add/remove individual interfaces to the bridge with ifup eth0, ifdown eth0.
Bridging for a Xen dom0
Bridging in a dom0 is a bit specific as it consists in bridging a real interface (i.e. ethX) with a virtual interface (i.e. vifX.Y). At bridge creation time, the virtual interface does not exist and will be added by the Xen toolstack when a domU is booting (see Xen documentation on how to link the virtual interface to the correct bridge).
- the bridge consists of a single physical interface
- the physical interface does not have an IP and is configured as manual
- the bridge will have the IP and will be auto, resulting in bringing up the physical interface
This translates to this sample config :
auto eth0 iface eth0 inet manual auto br0 iface br0 inet static address 192.168.0.253 netmask 255.255.255.0 gateway 192.168.0.254 bridge_ports eth0 bridge_stp 0
After the domU OS is started, the virtual interface wil be added and the working bridge can be checked with
brctl show ifconfig -a
Bridging for KVM
auto br0 iface br0 inet dhcp bridge_ports eth0 bridge_stp 0
Little script to allow dhcp over iptables
rc-update add local
cat >> /etc/local.d/iptables_dhcp_kvm.start << EOM echo 0 > /proc/sys/net/bridge/bridge-nf-call-arptables echo 0 > /proc/sys/net/bridge/bridge-nf-call-iptables echo 0 > /proc/sys/net/bridge/bridge-nf-call-ip6tables iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu exit 0 EOM
cat >> /etc/local.d/iptables_dhcp_kvm.stop << EOM exit 0 EOM
chmod +x /etc/local.d/iptables_dhcp_kvm.*
Bridging for QEMU
Replace /etc/network/interfaces with the following:
auto lo iface lo inet loopback auto br0 iface br0 inet dhcp bridge_ports eth0 bridge_stp 0
To enable DHCP and get QEMU to use the bridge we've created above, run:
apk add bridge echo 'tun' >> /etc/modules echo 'tap' >> /etc/modules echo 'allow br0' > /etc/qemu/bridge.conf echo 'net.ipv4.conf.br0.bc_forwarding=1' >> /etc/sysctl.conf sysctl -p echo 0 > /proc/sys/net/bridge/bridge-nf-call-iptables
After a reboot, you can use the bridge like so (assuming you have a qcow2 image named felix-pojtigners-theia.qcow2):
qemu-system-x86_64 -m 4096 -accel kvm -net nic -net bridge,br=br0 -boot d -drive format=qcow2,file=felix-pojtingers-theia.qcow2
If you don't get a DHCP response for the guest machine (assuming you have a DHCP server running on the physical network that eth0 is connected to), you can debug with tshark:
tshark -i eth0 -Y "bootp.option.type == 53"
Edit /etc/hostapd/hostapd.wpa_psk and insert the following, replacing PASSPHRASE with the WPA_PSK key you would like to use (remove keys that you don't want to use):
Edit /etc/hostapd/hostapd.conf and replace entries that need to be such as interface, bridge, driver, ssid, etc. Example file below:
interface=wlan0 bridge=br0 driver=hostap logger_syslog=-1 logger_syslog_level=2 logger_stdout=-1 logger_stdout_level=2 debug=0 dump_file=/tmp/hostapd.dump ctrl_interface=/var/run/hostapd ctrl_interface_group=0 ssid=SecureSSID #macaddr_acl=1 #accept_mac_file=/etc/hostapd/accept auth_algs=3 eapol_key_index_workaround=0 eap_server=0 wpa=3 wpa_psk_file=/etc/hostapd/hostapd.wpa_psk wpa_key_mgmt=WPA-PSK wpa_pairwise=CCMP
If you wish to use MAC address filtering, uncomment the lines starting with macaddr_acl and accept_mac_file, create /etc/hostapd/accept (with 600 permissions) and add the allowed clients' MAC address to the file.
Associate a few different clients to test.