1

In the documentation of Debian it is written that:

Just like you can bridge two wired ethernet interfaces, you can bridge between an ethernet interface and a wireless interface. However, most Access Points (APs) will reject frames that have a source address that didn’t authenticate with the AP. Since Linux does ethernet bridging transparently (doesn’t modify outgoing or incoming frames), we have to set up some rules to do this with a program called ebtables.

I wonder why a machine connected to the wired Ethernet interface can not authenticate with the AP. In such case, the bridge should work normally, shouldn't it?

6

The problem is that wireless frames in the regular mode only have space for three MAC addresses. The details are a bit more complex, but roughly speaking, there's one MAC address for the external interface of the "distribution system", as it is called in the standard (the collection of access points), one for the access point itself, and one for the station (client).

This is why you can bridge an access point, but not a station: There is no MAC address left for any other machine behind the station bridge. The MAC address of the station could be replaced by this address, but then the AP will reject it, as described in your quote, because this packet looks like it comes from another station that's not associated (and doesn't have encryption established, if you are using WPA).

Now there is a newer 4-address-mode (sometimes also called WDS = wire distribution system; sometimes WDS means a proprietary extensions), but you have to change all your WLAN devices to 4-address-mode for this to work.

Another option is to allow multiple stations on a single network interface - newer WLAN cards allow this, and then you could in principle use on of these as a proxy for the bridged machine (but it requires extra effort; simple bridging still won't do, because you have to hide the MAC address of the station).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.