0

I am trying to setup a wireless access point, managed by Hostapd and with dynamic VLAN support. The VLANs are managed dynamically by a FreeRadius server that I use for 802.X authentication.

I am using two devices to test my configuration : a laptop (address 192.168.0.2) and a phone (address 192.168.0.3). The two are using the same VLAN and can communicate with each others. But I am unable to ping the access point (address 192.168.0.1) from either one.

I have the following config for Hostapd :

###### GENERAL CONFIG ######
# define interface and driver
interface=wlp2s0
driver=nl80211
ssid=MUDDY
channel=1

# WPA2 enterprise auth
wpa=2
wpa_key_mgmt=WPA-EAP
wpa_pairwise=TKIP CCMP

# log level, all modules and somewhat verbose
logger_syslog=-1
logger_syslog_level=0
logger_stdout=-1
logger_stdout_level=1

# could be useful in the future
ctrl_interface=/var/run/hostapd
ctrl_interface_group=0

# we want 802.1x auth
ieee8021x=1

# whatever
eapol_key_index_workaround=0

# nope, no integrated eap
eap_server=0

###### RADIUS CONFIG ######
# probably irrelevant with nas_identifier set
own_ip_addr=127.0.0.1

# might make own_ip_addr irrelevant
#nas_identifier=my.nas

# address and port of RADIUS auth server
auth_server_addr=127.0.0.1
auth_server_port=1812
auth_server_shared_secret=somuchsecret

# we want accounting and be able to receive CoA messages
acct_server_addr=127.0.0.1
acct_server_port=1813
acct_server_shared_secret=somuchsecret

radius_das_port=3799
radius_das_client=127.0.0.1 thatsabigsecretohyeah

# accounting every minute
radius_acct_interim_interval=60

# VLANs are dealt with by the Radius server
dynamic_vlan=1

The interfaces created by Hostapd are as follows :

$ ip link
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: enp0s31f6: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP mode DEFAULT group default qlen 1000
    link/ether 98:4f:ee:14:16:23 brd ff:ff:ff:ff:ff:ff
3: wlp2s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP mode DEFAULT group default qlen 1000
    link/ether 34:f3:9a:b3:8d:69 brd ff:ff:ff:ff:ff:ff
8: wlp2s0.149: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq master brvlan149 state UNKNOWN mode DEFAULT group default qlen 1000
    link/ether 34:f3:9a:b3:8d:69 brd ff:ff:ff:ff:ff:ff
9: brvlan149: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP mode DEFAULT group default qlen 1000
    link/ether 34:f3:9a:b3:8d:69 brd ff:ff:ff:ff:ff:ff

When my laptop sends an ARP request, the reply is sent through the brvlan149 bridge, and through the wlp2s0.149 port.

However, the ARP request to retrieve my laptop's IP (necessary to send the ping reply) is sent from the wlp2s0 interface, and the laptop never receives it.

I do not understand this behavior, and how Hostapd (or Linux) manages the interfaces. I am using version 2.6 of Hostapd.

I have deactivated reverse path filtering, as this seemed to be causing issues in similar configurations.

The routes I have are the following :

$ ip route show table all
default via 192.168.234.1 dev enp0s31f6  proto static  metric 100 
130.225.68.3 via 192.168.234.1 dev enp0s31f6  proto dhcp  metric 100 
169.254.0.0/16 dev enp0s31f6  proto static  scope link  metric 1000 
192.168.0.0/24 dev wlp2s0  proto kernel  scope link  src 192.168.0.1 
192.168.234.0/24 dev enp0s31f6  proto kernel  scope link  src 192.168.234.177  metric 100 
broadcast 127.0.0.0 dev lo  table local  proto kernel  scope link  src 127.0.0.1 
local 127.0.0.0/8 dev lo  table local  proto kernel  scope host  src 127.0.0.1 
local 127.0.0.1 dev lo  table local  proto kernel  scope host  src 127.0.0.1 
broadcast 127.255.255.255 dev lo  table local  proto kernel  scope link  src 127.0.0.1 
broadcast 192.168.0.0 dev wlp2s0  table local  proto kernel  scope link  src 192.168.0.1 
local 192.168.0.1 dev wlp2s0  table local  proto kernel  scope host  src 192.168.0.1 
broadcast 192.168.0.255 dev wlp2s0  table local  proto kernel  scope link  src 192.168.0.1 
broadcast 192.168.234.0 dev enp0s31f6  table local  proto kernel  scope link  src 192.168.234.177 
local 192.168.234.177 dev enp0s31f6  table local  proto kernel  scope host  src 192.168.234.177 
broadcast 192.168.234.255 dev enp0s31f6  table local  proto kernel  scope link  src 192.168.234.177 
fe80::/64 dev enp0s31f6  proto kernel  metric 256  pref medium
fe80::/64 dev wlp2s0  proto kernel  metric 256  pref medium
fe80::/64 dev wlp2s0.149  proto kernel  metric 256  pref medium
fe80::/64 dev brvlan149  proto kernel  metric 256  pref medium
local ::1 dev lo  table local  proto kernel  metric 0  pref medium
local fe80::36f3:9aff:feb3:8d69 dev wlp2s0  table local  proto kernel  metric 0  pref medium
local fe80::36f3:9aff:feb3:8d69 dev wlp2s0.149  table local  proto kernel  metric 0  pref medium
local fe80::6c8a:e7ff:fe1a:55cc dev brvlan149  table local  proto kernel  metric 0  pref medium
local fe80::d124:3999:7e3:55fe dev enp0s31f6  table local  proto kernel  metric 0  pref medium
ff00::/8 dev enp0s31f6  table local  metric 256  pref medium
ff00::/8 dev wlp2s0  table local  metric 256  pref medium
ff00::/8 dev wlp2s0.149  table local  metric 256  pref medium
ff00::/8 dev brvlan149  table local  metric 256  pref medium

The details concerning the bridge are :

$ ip -details link show brvlan149
5: brvlan149: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP mode DEFAULT group default qlen 1000
    link/ether 34:f3:9a:b3:8d:69 brd ff:ff:ff:ff:ff:ff promiscuity 0 
    bridge forward_delay 0 hello_time 200 max_age 2000 ageing_time 30000 stp_state 0 priority 32768 vlan_filtering 0 vlan_protocol 802.1Q addrgenmode eui64

How can I make the ARP requests from the access point be sent from the right interface ?

  • You're right, I was mixing up the bridge (brvlan149) and the bridge port wlp2s0.149. This makes more sense now. Will edit my question with the output of the command. – Twoflower Apr 3 at 13:12
  • I believe this bridge parameter would allow me to create a bridge with, e.g., a wired interface. But that would mean leaving all routing to the router behind the access point, and that's not what I want. I would like to be able to manage the local network on the access point. – Twoflower Apr 8 at 9:41
  • I just mistakenly connected the enp0s31f6 interface to the brvlan149 bridge, and it worked wonderfully. I got everything coming from the ethernet network. However, with the same operation on the wlp2s0, I got nothing. I'm beginning to think this might be a driver problem. stackoverflow.com/questions/13082706/… – Twoflower Apr 8 at 12:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.