[2024-feb-29] Sad news: Eric Layton aka Nocturnal Slacker aka vtel57 passed away on Feb 26th, shortly after hospitalization. He was one of our Wiki's most prominent admins. He will be missed.
Differences
This shows you the differences between two versions of the page.
Both sides previous revisionPrevious revisionNext revision | Previous revisionNext revisionBoth sides next revision | ||
howtos:network_services:running_an_access_point_from_a_slackware_box [2016/11/18 15:03 (UTC)] – [4.7.2 Slackware Wireless Clients] louigi600 | howtos:network_services:running_an_access_point_from_a_slackware_box [2022/11/13 04:21 (UTC)] – [5.5 Virtual AP] louigi600 | ||
---|---|---|---|
Line 1: | Line 1: | ||
====== Setting up a WiFi Access Point on your Slackware Box ====== | ====== Setting up a WiFi Access Point on your Slackware Box ====== | ||
You should read this, regardless of whether you are a Slackware enthusiast or not, because you will find most of it applicable to other distributions too. | You should read this, regardless of whether you are a Slackware enthusiast or not, because you will find most of it applicable to other distributions too. | ||
+ | I have recently reused most of this on a debian/ | ||
====== 1 Preamble ====== | ====== 1 Preamble ====== | ||
There are endless reasons for wanting to run an AP from a standard Linux environment as opposed to the crippled ones that come in most AP appliances, we're not here to discuss them all but if you're reading this you've found your own motivation for doing it. | There are endless reasons for wanting to run an AP from a standard Linux environment as opposed to the crippled ones that come in most AP appliances, we're not here to discuss them all but if you're reading this you've found your own motivation for doing it. | ||
Line 15: | Line 16: | ||
Look at the section | Look at the section | ||
| | ||
- | software | + | Supported |
* AP/VLAN | * AP/VLAN | ||
* monitor | * monitor | ||
- | AP needs to be among the software | + | AP needs to be among the Supported |
Ok there is still some Wireless NICs that support hardware master mode but that's 3 against all the rest I'm not going to bother going into any detail with those 3 exceptions, google is your friend if you want to insist in the hardware master mode way. | Ok there is still some Wireless NICs that support hardware master mode but that's 3 against all the rest I'm not going to bother going into any detail with those 3 exceptions, google is your friend if you want to insist in the hardware master mode way. | ||
+ | |||
+ | |||
+ | Should you want to have Virtual Access Poits (more than one AP on a single physical wireless NIC) you will want to look at the section "valid interface combinations" | ||
+ | Here's the output from two cards : | ||
+ | |||
+ | [root@nuc8i5 ~]# for Phy in $(iw dev |grep ^phy); do echo " | ||
+ | phy#1 | ||
+ | valid interface combinations: | ||
+ | * #{ AP, mesh point } <= 8, | ||
+ | total <= 8, #channels <= 1 | ||
+ | phy#0 | ||
+ | valid interface combinations: | ||
+ | * #{ managed } <= 1, #{ AP, P2P-client, P2P-GO } <= 1, #{ P2P-device } <= 1, | ||
+ | total <= 3, #channels <= 2 | ||
+ | [root@nuc8i5 ~]# | ||
+ | | ||
+ | The first one would allow more than on vAP (up to a maximum of 8) but they all got to be on the same channel. | ||
+ | The second one would allow for one AP and one managed client to be used at the same time even of different channels but the total number of live APs need to be no more than one. | ||
====== 3 Software Requirements ====== | ====== 3 Software Requirements ====== | ||
Line 73: | Line 92: | ||
* rp-pppoe (*) | * rp-pppoe (*) | ||
- | (*) only if you want your AP to actually manage your internet connection. | + | (*) only if you want your AP to actually manage your internet connection |
===== 3.3 Other Software ===== | ===== 3.3 Other Software ===== | ||
* hostapd | * hostapd | ||
+ | * miniupnpd (only required if you have appliances that require upnp) | ||
- | Hostapd is not shipped with Slackware | + | Neither of these are included in the slackare installation |
To obtain hostapd you could either download a binary version from some reliable source or compile it from sources. You might be slightly better off compiling from sources, so that you get e fairly recent version, but it's up to you. Just don't try using really old hostapd versions like 0.6.7 on 2.6+ kernels: hostapd has followed the kernel wireless stack drivers and transitioned from only supporting FullMAC devices to supporting SoftMAC on almost all devices trough nl80211. Nowadays the combination of both hardware and driver supporting FullMAC is hard to come by (Prism2/ | To obtain hostapd you could either download a binary version from some reliable source or compile it from sources. You might be slightly better off compiling from sources, so that you get e fairly recent version, but it's up to you. Just don't try using really old hostapd versions like 0.6.7 on 2.6+ kernels: hostapd has followed the kernel wireless stack drivers and transitioned from only supporting FullMAC devices to supporting SoftMAC on almost all devices trough nl80211. Nowadays the combination of both hardware and driver supporting FullMAC is hard to come by (Prism2/ | ||
- | Hostapd sources can be downloaded from [[http:// | + | Hostapd sources can be downloaded from [[http:// |
Compiling hostapd is really simple: | Compiling hostapd is really simple: | ||
- extract the sources | - extract the sources | ||
Line 89: | Line 109: | ||
- edit the defconfig file and enable any optional features you need (default is fine for a simple setup) | - edit the defconfig file and enable any optional features you need (default is fine for a simple setup) | ||
- copy the defconfig file to .config | - copy the defconfig file to .config | ||
+ | - make a softlink for netlink includes (cd / | ||
- make | - make | ||
- make install (or optionally just put in / | - make install (or optionally just put in / | ||
Line 97: | Line 118: | ||
If your AP also acts a router it's probably going to be exposed to malware and even if you do your best to keep malicious users out of your work they might still find a way in. If your router is exposed to internet you might want to consider some sort of file integrity tool that would alert you if files have been tampered with. File integrity checking could be a whole article so I'm not going to go into any detail beyond advising to read more about it on security oriented communities like [[http:// | If your AP also acts a router it's probably going to be exposed to malware and even if you do your best to keep malicious users out of your work they might still find a way in. If your router is exposed to internet you might want to consider some sort of file integrity tool that would alert you if files have been tampered with. File integrity checking could be a whole article so I'm not going to go into any detail beyond advising to read more about it on security oriented communities like [[http:// | ||
====== 4 Configuring ====== | ====== 4 Configuring ====== | ||
- | Now let's have a look at how to configure everything | + | Now let's have a look at how to configure everything |
===== 4.1 Hostapd ===== | ===== 4.1 Hostapd ===== | ||
Line 116: | Line 137: | ||
* hw_mode=g | * hw_mode=g | ||
* channel=6 | * channel=6 | ||
+ | * ieee80211d=1 | ||
+ | * country_code=IT | ||
+ | * ieee80211n=1 | ||
+ | * auth_algs=1 | ||
* macaddr_acl=1 # see notes below | * macaddr_acl=1 # see notes below | ||
* # 0 = accept unless in deny list (iptables mac filtering and optionally have a ban list) | * # 0 = accept unless in deny list (iptables mac filtering and optionally have a ban list) | ||
Line 123: | Line 148: | ||
* wpa=2 | * wpa=2 | ||
* wpa_psk_file=/ | * wpa_psk_file=/ | ||
- | * wpa_key_mgmt=WPA-PSK | + | * wpa_key_mgmt=WPA-PSK |
- | * wpa_pairwise=TKIP | + | |
* rsn_pairwise=CCMP | * rsn_pairwise=CCMP | ||
* wpa_group_rekey=600 | * wpa_group_rekey=600 | ||
Line 179: | Line 203: | ||
* interface=br0 | * interface=br0 | ||
+ | * bogus-priv | ||
+ | * local=/ | ||
+ | * domain=local | ||
* except-interface=lo | * except-interface=lo | ||
- | * bind-interfaces | ||
* listen-address=192.168.0.1 | * listen-address=192.168.0.1 | ||
* dhcp-range=192.168.0.2, | * dhcp-range=192.168.0.2, | ||
* dhcp-leasefile=/ | * dhcp-leasefile=/ | ||
* conf-dir=/ | * conf-dir=/ | ||
+ | The options local and domain allow dnsmasq to tell clients they belong to a domain and in return serve as authoritative for that domain. Some distributions that use NetworkManager will not get local resolution to work unless yo define these 2 options. | ||
The options except-interface bind-interfaces and listen-address are particularly useful if you want to run more then one instance of dnsmasq. | The options except-interface bind-interfaces and listen-address are particularly useful if you want to run more then one instance of dnsmasq. | ||
Line 194: | Line 221: | ||
Now is a good time to configure your firwall protection. | Now is a good time to configure your firwall protection. | ||
Supposing that the box will be routing packages thought it I'll show some rules that you might find helpfull. | Supposing that the box will be routing packages thought it I'll show some rules that you might find helpfull. | ||
+ | |||
+ | Newer kernels nswitched to nftables but you can still use iptables to manipulate the kernel netfilter tables. | ||
+ | Actually if you want to move to using nftables but you are not familiar with the syntax you can save the kernel netfilter tables in netfilter format like this: | ||
+ | |||
+ | nft list ruleset > nftables.conf | ||
+ | |||
+ | Personally I'm still struggling with nft syntax so I will keep the rest of this chapter in iptabls syntax: you can convert, like I showed above, after you are done. | ||
+ | |||
This is the output of iptables-save, | This is the output of iptables-save, | ||
The iptables-save/ | The iptables-save/ | ||
Line 399: | Line 434: | ||
It should then be possible to restart rc.inet1 (or just rc.inet1 wlan0_down and rc.inet1 wlan0_up) and the client should associate. | It should then be possible to restart rc.inet1 (or just rc.inet1 wlan0_down and rc.inet1 wlan0_up) and the client should associate. | ||
- | There' | + | There' |
# wpa_supplicant -B -W -Dwext -i wlan0 -c / | # wpa_supplicant -B -W -Dwext -i wlan0 -c / | ||
Line 443: | Line 478: | ||
in it the above snippet would have saved the new network to wpa_supplicant.conf and associated you with it. | in it the above snippet would have saved the new network to wpa_supplicant.conf and associated you with it. | ||
- | Remember that if you' | + | Remember that if you' |
> set_network 0 ssid " | > set_network 0 ssid " | ||
OK | OK | ||
> set_network 0 key_mgmt NONE | > set_network 0 key_mgmt NONE | ||
+ | OK | ||
+ | > | ||
+ | |||
+ | |||
==== 4.7.3 Other Linux Distributions Wireless Clients ==== | ==== 4.7.3 Other Linux Distributions Wireless Clients ==== | ||
- | I've tried various other flavor distributions ... most don't use wpa_gui for associating to AP but some sort of other tool that generally pops up when you click on the icon that notifies the presence of an Access Point. After a few headaches I found that best association success is achieved by forcing setup for hidden AP even if the AP I'm configuring has not the hidden essid. | + | I've tried various other flavor distributions ... most don't use wpa_gui for associating to AP but some sort of other tool that generally pops up when you click on the icon that notifies the presence of an Access Point. After a few headaches I found that best association success is achieved by forcing setup for hidden AP even if the AP I'm configuring has not the hidden essid. You can always use wpa_cli on the command line if it's shipped with whatever distro you prefer. |
Line 556: | Line 595: | ||
Please note the above script only works on 2.6 kernels or above. This probably also applies to socklist. | Please note the above script only works on 2.6 kernels or above. This probably also applies to socklist. | ||
+ | |||
+ | ===== 5.5 Virtual AP ===== | ||
+ | If your wireless NIC supports it you might like to run multiple virtual APs. As mentioned in Chapter 2 to be able to do this | ||
+ | you will need the "valid interface combinations" | ||
+ | If this is the case then you can add virtual AP like this | ||
+ | |||
+ | iw phy0 interface add vap0 type __ap | ||
+ | or | ||
+ | iw wlan0 interface add vap0 type __ap | ||
+ | | ||
+ | this will create a new virtual AP, arbitrarily called vap0 on which you will need to activate a separate instance of hostapd as explained in Chapter 4. | ||
+ | Incidentally the type can be any of of these (as long as your wireless NIC supports them): | ||
+ | |||
+ | * monitor | ||
+ | * managed | ||
+ | * wds | ||
+ | * mesh | ||
+ | * ibss | ||
+ | * __ap | ||
+ | |||
+ | |||
+ | if you subsequentlt want to remove the virtual AP toy can terminate the hostapd running on it, optionally put the nick in down state and then tell iw you want to delete the virtual device: | ||
+ | |||
+ | iw vap0 del | ||
+ | | ||
====== 6 Remote Administration ====== | ====== 6 Remote Administration ====== | ||
Line 932: | Line 996: | ||
* save the random-seed to unused sector on flash when shutting down (rc.0 ... well it's a link to rc.6) and load it back to / | * save the random-seed to unused sector on flash when shutting down (rc.0 ... well it's a link to rc.6) and load it back to / | ||
- | You could optionally have fstab specify that root should be mounted ro like this: | + | You could optionally have fstab specify that root should be mounted ro like this: (example below is relative to when I was using ubifs on the DocStar) |
- | / | + | |
- | You will also haveto | + | You will also have to make some links in various places so that they end up writing in /run that has been mounted tmpfs. I do that manually just once with / mounted rw and then remount it ro. |
If you're interested in actually making such changes to the init scripts I've shared how I go about it on [[http:// | If you're interested in actually making such changes to the init scripts I've shared how I go about it on [[http:// | ||
Line 967: | Line 1031: | ||
I'm not going to miss my old low end AP, are you ? | I'm not going to miss my old low end AP, are you ? | ||
I replaced it with home-brew stuff from which this article is derived. | I replaced it with home-brew stuff from which this article is derived. | ||
- | Over the years I've done several remakes adding some new features. The last upgrade was 8 programmable | + | Over the years I've done several remakes adding some new features. The last upgrade was using a Friendlyelec NanoPi R1S with integrated wifi and 2 ethernet nics requiring no extra usb dongles. |
+ | |||
+ | Gen 5 (Friendlyelec NanoPI R1S) | ||
+ | |||
+ | {{howtos: | ||
+ | |||
+ | The original case has 2 issues: cappy internal antenna and tendency to overheat ... so I 3d-printed my own [[https:// | ||
+ | |||
+ | {{howtos: | ||
+ | |||
+ | Gen 4 (RPi2 with display) | ||
+ | |||
+ | {{howtos: | ||
+ | |||
+ | |||
+ | Gen 3 (RPi2 with buttons and leds) | ||
+ | |||
+ | {{howtos: | ||
+ | |||
+ | Gen 2 (RPi2 in aluminum Sandwich) | ||
+ | |||
+ | {{howtos: | ||
+ | |||
+ | Gen 1 (Seagate DocStar in aluminum Sandwich) | ||
- | {{http:// | + | {{howtos:network_services:g1_seagate_docstar.jpg| Seagate DocStart}} |
- | {{http:// | + | |
- | {{http:// | + | |