How to setup wireless AP with two wifi cards and ethernet as WAN on debian?

Question

I'm trying to build wireless AP with 2 Atheros cards (AR5413 / AR5414 both), and one ethernet card to act as WAN. I am also having doubts if I should use ath5k or madwifi drivers. I've tried both already but none worked as I wanted

Here is what I want (if possible):

1. wireless cards (wlan0 / wlan1) in ap/master mode
2. wpa2 encryption on both interfaces
3. each wireless interface has static IP (ex: 10.0.1.1 for wlan0, and 10.0.2.1 for wlan1)
4. each wireless interface has dhcp-server for managing client's addresses (ex: pool for wlan0: 10.0.1.100-10.0.1.120, pool for wlan0: 10.0.2.100 - 10.0.2.120)
5. eth0 should be WAN interface with dhcp-client (public ip)
6. forward traffic (and internet) from WAN to wireless interfaces (not sure how this should be done... iptables+dnsmasq?)
7. QoS control (optional)

I've tried and managed to get wireless essid on box using hostapd (with WPA2 working), but it requires bridge (br0) interface to work (not sure how). This bridge forces ethernet and wireless card not to have IP addresses and bridge takes public IP from cable modem via eth0. As I try to connect my wireless ESSID my client machine (cell phone for ex.) can't get IP (no dhcp-server) and I don't know what configuration to put addresses manually because there is no local IP on wlan0 interface itself.

Just to recap:

[INTERNET] <---- eth0(WAN) <----?NAT?----> wlan0/wlan1

Any suggestion is welcome (due concept or implementation).

Answer 1

Yes it is possible to create one or 2 APs using 2 wifi card and one ethernet interface

Install the hostapd package and the create_ap tool :

sudo apt install hostapd
git clone https://github.com/oblique/create_ap
cd create_ap
sudo make install

Create the first AP : AP1

create_ap wlan0 eth0 MyAP1 MyPassPhrase1

Create the second AP : AP2

create_ap wlan1 eth0 MyAP2 MyPassPhrase2

You can specify the driver --driver ath5k as motioned by the create_ap developper's.

Next step you should edit your /etc/dnsmasq.conf to bind a MAC address to a specific IP address. Add the following line

#The `wlan0`:

dhcp-host:XX:XX:XX:XX:XX,10.0.1.1

#The dhcp range :

interface=wlan0
except-interface=wlan1
dhcp-range=10.0.1.100,10.0.1.120

#The `wlan1`:

dhcp-host:XX:XX:XX:XX:XX,10.0.2.1
#The dhcp range :

interface=wlan1
except-interface=wlan0
dhcp-range=10.0.2.100,10.0.2.120

Change the XX:XX:XX:XX:XX with the MAC adress of your wlan0 and wlan1

Answer 2

Possible and IMO easiest solution for the router:

[INTERNET] ppp0 <--- NAT --> br0 <-- --> wlan0/1

br0 has an assigned local IP, and wlan0,wlan1 are managed by bridge. You can add them with post-up brctl addif br0 wlan0 for wlan0.

So, you need to edit your /etc/network/interfaces for ppp0, br0, wlan0, wlan1. After ppp0 (or whatever you have) is up apply these

echo "1" > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A POSTROUTING -o ppp0 -s 10.0.2.0/24 -j MASQUERADE

But! For production environment you need a good firewall.