1

I'm experimenting with a Raspberry Pi 3 Model B (running arch linux) and its WLAN module.

Until today I had Pi Hole running on it for my entire network. The Pi stands where we have very poor Wifi reception for mobile phones so I decided to add Wifi AP to the Pi.

Now the strange thing is that the WLAN AP is working perfectly (set up in bridged mode like described @ https://www.raspberrypi.org/documentation/configuration/wireless/access-point.md) but I can't do DNS requests to the Pi anymore.

dig pi.home @192.168.1.150
; <<>> DiG 9.13.5 <<>> pi.home @192.168.1.150
;; global options: +cmd
;; connection timed out; no servers could be reached

Even more confusing is the fact that as soon I load the Pi Hole web interface in Chrome once, DNS is working again.

I currently have the following configuration.

Pi-Hole's DNS server listens on all interfaces

bridge configuration

cat /etc/netctl/bridge
Description="WAP Bridge"
Interface=br0
Connection=bridge
BindsToInterfaces=(eth0 wlan0)
IP=no
ExecUpPost="ip link set dev br0 address $(cat /sys/class/net/eth0/address); IP=dhcp; ip_set"
ExecDownPre="IP=dhcp"
SkipForwardingDelay=yes

iptables

cat /etc/iptables/iptables.rules
*nat
:PREROUTING ACCEPT [4:196]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -o eth0 -j MASQUERADE
COMMIT
*filter
:INPUT ACCEPT [88:10291]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [31:4764]
-A FORWARD -i eth0 -o wlan0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i wlan0 -o eth0 -j ACCEPT
COMMIT

ifconfig

ifconfig
br0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.1.150  netmask 255.255.255.0  broadcast 192.168.1.255
        inet6 xyxyxy  prefixlen 64  scopeid 0x20<link>
        ether xyxyxy  txqueuelen 1000  (Ethernet)
        RX packets 2537  bytes 468919 (457.9 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 267  bytes 60665 (59.2 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

eth0: flags=4419<UP,BROADCAST,RUNNING,PROMISC,MULTICAST>  mtu 1500
        inet6 xyxyxy  prefixlen 64  scopeid 0x20<link>
        ether xyxyxy  txqueuelen 1000  (Ethernet)
        RX packets 2560  bytes 473036 (461.9 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 297  bytes 70500 (68.8 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1000  (Local Loopback)
        RX packets 109  bytes 8338 (8.1 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 109  bytes 8338 (8.1 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

wlan0: flags=4419<UP,BROADCAST,RUNNING,PROMISC,MULTICAST>  mtu 1500
        inet6 xyxyxy  prefixlen 64  scopeid 0x20<link>
        ether xyxyxy  txqueuelen 1000  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 2276  bytes 529781 (517.3 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

IPv4 forwarding

cat /etc/sysctl.d/ipv4forwarding.conf
net.ipv4.ip_forward = 1

/etc/dhcpd.conf contains

[...]
denyinterfaces eth0
denyinterfaces wlan0

/etc/hotapd/hostapd.conf (if this is needed)

cat /etc/hostapd/hostapd.conf
interface=wlan0
bridge=br0
driver=nl80211
ssid=<SSID>
hw_mode=g
channel=7
wmm_enabled=0
macaddr_acl=0
auth_algs=1
ignore_broadcast_ssid=0
wpa=2
wpa_passphrase=<PASSWORD>
wpa_key_mgmt=WPA-PSK
wpa_pairwise=TKIP
rsn_pairwise=CCMP

Anyone ideas? Can this be related to "permit all origins" in the DNS setting of Pi Hole?

  • 1
    Why do you have IP Forwarding rules when you're bridging? – roaima Jan 11 at 23:49
  • @roaima I somehow thought this is still needed. – Tony Stark Jan 11 at 23:59
0

The solution was to add Gateway to br0 and remove IPv4 forwarding and all iptables rules.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.