I am trying to create a network bridge to allow virtual machines to use my wireless card to connect to my home network. My plan was to do something like:

iw dev wlp12s0 set 4addr on
brctl addbr xenbr0
brctl addif xenbr0 wlp12s0
ip link set dev xenbr0 up
wpa_supplicant -B -b xenbr0 -i wlp12s0 -c <(wpa_passphrase $MYSSID $MYPASSPHARSE)
dhcpcd xenbr0
ebtables -t nat -A POSTROUTING -s $VMMAC -j snat --to-source $HOSTMAC

Which I think works in principle, but my wireless router cannot handle

iw dev wlp12s0 set 4addr on

even if I do not setup a bridge. I would consider buying a new wireless router if this is the correct approach and there is an affordable home router that is known to work. Is there a different way of tackling the problem?

  • You need to have 4addr on both sides as it's a different frame format. If you buy a new router, pick one supported by OpenWRT, install this alternative linux-based firmware and configure it to your liking. Dec 26, 2014 at 21:06
  • Turn on and configure WDS otherwise known as Wireless Distribution System. This will loosen up the requirement that all MAC addresses talking on WiFi are associated with the Access Point(s).
    – rjt
    Jan 13, 2015 at 7:48
  • interesting idea rjt. One question, if the VMs got the IP from DHCP, why should not they be accepted by the AP? Nov 19, 2015 at 20:13
  • It is a security thing. The AccessPoint is expecting only one MAC per association. The VM has a separate MAC address, is talking on WiFi but using plain ethernet, not WiFi. A WirelessDistributionSystem is essentially a MESH network of switches in which security level is brought down a few notches.
    – rjt
    Dec 8, 2017 at 5:04

1 Answer 1


My problem with the WDS / 4addr solutions is my Virtual Machines are on a laptop and i roam with that laptop. So WDS seemed simple until one remembers HomeSSID is not the only wLan. Most people do not have total control of the wireless networks they connect to.

"Bridging with a wireless NIC" shows how to do it without special network infrastructure.

  • I have seen the Debian wiki, but could not get it to work. Is it really just running the three ebtables commands?
    – StrongBad
    Jan 13, 2015 at 9:37
  • It is more than three as there are special atomic save and atomic commit commands to get the kernel to see the user-space rules. These atomic commands are documented in the next section of the same webpage, but due to formatting, could be mistaken for something else entirely. Further, these atomic commands will not survive a reboot unless added to something like /etc/rc.local. Always verify the rules "stuck" with ebtables -L.
    – rjt
    Dec 6, 2017 at 15:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .