Problem with hostapd

[TheUnicorn]

Hey guys!
I tried to use my RPi 3 as a wifi hotspot using follow website:
https://frillip.com/using-your-raspberr ... h-hostapd/
The guide says I can test my confics using next code. Then the network will show up at the wifi list, but you cannot connect to it.

Code: Select all

sudo /usr/sbin/hostapd /etc/hostapd/hostapd.conf

And my Pi says:

Code: Select all

Configuration file: /etc/hostapd/hostapd.conf
Failed to create interface mon.wlan0: -95 (Operation not supported)
wlan0: Could not connect to kernel driver
Using interface wlan0 with hwaddr b8:27:eb:fa:89:2d and ssid "Pi3-AP"
wlan0: interface state UNINITIALIZED->ENABLED
wlan0: AP-ENABLED

Then I can see my network on the list.
After I have set up other files, I have to turn hostapd and dnsmasq on. Even if I do that, my wifi wont show up, and i cant connect to it. What I can do? Can anyone help me? I apologize for my bad English, and thank you for your time!

[epoch1970]

I think you should post your hostapd.conf it would be easier to understand what's going on.
Also I am not so sure why the blog post author didn't use bridging. If the objective is to setup a wireless access point in the LAN, and have the wifi clients treated as 1st-class citizens, then go for bridging (and do away with dnsmasq and routing configuration on the Pi)
If the goal is more like hotspot with access to limited services then the approach in said post is fine, but it doesn't document the firewall setup.

FWIW, a working hostapd.conf file taken from my Pi 3 (slightly edited, comments removed, using a bridge):

Code: Select all

ssid=your_SSID
wpa_passphrase=your_suitably_long_passphrase_in_clear_text
interface=wlan0
bridge=br0
channel=6
ctrl_interface_group=0
ctrl_interface=/var/run/hostapd
max_num_sta=25
wpa=2
auth_algs=1
wpa_key_mgmt=WPA-PSK
rsn_pairwise=CCMP
macaddr_acl=0
accept_mac_file=/etc/hostapd/hostapd.whitelist
deny_mac_file=/etc/hostapd/hostapd.blacklist
ignore_broadcast_ssid=0
driver=nl80211
hw_mode=g
ieee80211n=1
ieee80211d=1
country_code=your_uppercase_2-letter_country_code
ieee80211h=1
wme_enabled=1
wmm_enabled=1
logger_syslog=-1
logger_syslog_level=3
logger_stdout=-1
logger_stdout_level=3

[TheUnicorn]

Thank you for your reply. My hostapd.conf looks like this:

Code: Select all

# This is the name of the WiFi interface we configured above
interface=wlan0
# Use the nl80211 driver with the brcmfmac driver
driver=nl80211
# This is the name of the network
ssid=WifiPi
# Use the 2.4GHz band
hw_mode=g
# Use channel 6
channel=6
# Enable 802.11n
ieee80211n=1
# Enable WMM
wmm_enabled=1
# Enable 40MHz channels with 20ns guard interval
ht_capab=[HT40][SHORT-GI-20][DSSS_CCK-40]
# Accept all MAC addresses
macaddr_acl=0
# Use WPA authentication
auth_algs=1
# Require clients to know the network name
ignore_broadcast_ssid=0
# Use WPA2
wpa=2
# Use a pre-shared key
wpa_key_mgmt=WPA-PSK
# The network passphrase
wpa_passphrase=raspberry
# Use AES, instead of TKIP
rsn_pairwise=CCMP

Should I use the bridging, and remove dnsmasq?

[epoch1970]

Should I use the bridging, and remove dnsmasq?

Well it depends on what you want to achieve. Do you want an AP on your LAN for the wireless devices you own (then bridge is best) or do you want some sandboxed internet access over wifi (then your current route is the right one) ?

I trust you've compared the hostapd files. I see you're using "ht_capab=" with 40MHz width, AFAIK this is not neighborly in the 2.4GHz band, this is not standard and can prevent some clients to connect or even "see" the AP, and last but not least it won't provide much of a performance difference on the Pi. I would try to remove that line completely and see how it fares.

If you think you should bridge, then I would use a setup like this in /etc/network/interfaces (derived from experience, I am not running this exactly)

Code: Select all

auto lo
iface lo inet loopback

auto eth0
iface eth0 inet manual

# Builtin Broadcom BCM43438 chipset
# Special name defined in /etc/udev/rules.d/70-network_interfaces.rules
auto wap0
iface wap0 inet manual
# Change the MAC to a custom one with low MSB so that the bridge adopts it.
pre-up ip link set dev wap0 address 02:ff:00:01:02:03

# L3 bridge
auto lanbr
iface lanbr inet dhcp
bridge-stp on
bridge-maxwait 2
bridge-fd 2
bridge-ports wap0 eth0

NOTES:

• I do not use dhcpcd, so I can't guarantee the setup would work for you as is.
• Using fancy names like wap0 instead of wlan0 or lanbr instead of br0 is not a requirement at all. For the bridge, I just do that because my setups often have a few bridges, it's easier to read. For the wireless interface, since there is some dependency between hostapd.conf and the interface hardware, I always worry the wlan0 name might get used by a random USB wireless key added to the machine, breaking the AP functionality. Hence the fixed name defined in a custom udev rule.
• I am changing the MAC address of the wifi card, this is not mandatory either. A linux bridge adopts the same MAC address as the lowest one among its interface members. Given the moment at which interfaces are added, the bridge might change MAC address. This is not good if you want to use DHCP with a fixed address reservation for the bridge, and wifi clients don't like the MAC of the AP to change suddenly... So while the bridge here only contains internal interfaces that are not going anywhere, I prefer to tighten the configuration in case one day I decide to add another random interface to the bridge.
  (also, I think this trick could help having the bridge negotiate an address with an AP if the wireless configuration is changed to client -aka STA- mode one day. Bridging a wifi interface in STA mode is not standard so I doubt it works, but with some hw/drivers combinations I've seen it work, on condition the bridge has the same MAC as the STA interface.)

Finally, here is the relevant snippet in 70-network_interfaces.rules:

Code: Select all

# Built-in wifi interface used in hostap for the AP
# identify device by MAC address
SUBSYSTEM=="net", ACTION=="add", ATTR{address}=="b8:27:eb:01:02:03", NAME="wap0"

HTH

[TheUnicorn]

I think bridge is right one for me. Do you have some kind of guide for setuping the bridge, for definitely beginners? Thats what I need!

[epoch1970]

Incredibly, I can't find a post that presents this simple setup. So I gave it a go.

Objective: Have wireless devices connect through your Pi 3 to your local LAN. Not a hotspot, no firewall, a simple transparent bridge that allows wireless clients to use LAN resources (DHCP server, router, DNS server.)
Hardware prerequisites: a Pi 3 with wired access to the LAN, a (home) router providing the usual DHCP, DNS firewalling/routing services.
Software prerequisites: raspbian, hostapd (apt-get install hostapd), brctl (apt-get install bridge-utils)
Caveats:

• Not tested against dhcpcd. (I don't use it on my Pi)
• Do not attempt this if you only have remote (ssh, X or vnc...) access to the Pi. You will disrupt connectivity and might lose contact with the Pi. To setup this comfortably you need local access to the Pi, through the text or graphical console.
• This was not written starting with a clean raspbian install. There might be some discrepancies between what you read and what you see. I expect they would be minor.

1. Prologue
Connect the ethernet cable to the Pi 3, boot it and verify it has connectivity.

Start a terminal or use the console to log in your Pi 3.

Now have a look at file /etc/network/interfaces which defines networking setup for the machine. It should look like this:

Code: Select all

admin@berck:~ $ cat /etc/network/interfaces
# interfaces(5) file used by ifup(8) and ifdown(8)

# Please note that this file is written to be used with dhcpcd
# For static IP, consult /etc/dhcpcd.conf and 'man dhcpcd.conf'

# Include files from /etc/network/interfaces.d:
source-directory /etc/network/interfaces.d

auto lo
iface lo inet loopback

iface eth0 inet manual

allow-hotplug wlan0
iface wlan0 inet manual
    wpa-conf /etc/wpa_supplicant/wpa_supplicant.conf

allow-hotplug wlan1
iface wlan1 inet manual
    wpa-conf /etc/wpa_supplicant/wpa_supplicant.conf

Verify the current IP configuration. You should get something like this:

Code: Select all

admin@berck:~ $ ifconfig
eth0      Link encap:Ethernet  HWaddr b8:27:eb:01:02:03  
          inet addr:172.17.255.192  Bcast:172.17.255.255  Mask:255.255.0.0
          inet6 addr: fe80::ba27:ebff:fe01:0203/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:991 errors:0 dropped:0 overruns:0 frame:0
          TX packets:470 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:81898 (79.9 KiB)  TX bytes:78496 (76.6 KiB)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:158 errors:0 dropped:0 overruns:0 frame:0
          TX packets:158 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1 
          RX bytes:14314 (13.9 KiB)  TX bytes:14314 (13.9 KiB)

wlan0     Link encap:Ethernet  HWaddr b8:27:eb:11:12:13  
          UP BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:1 errors:0 dropped:1 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:60 (60.0 B)  TX bytes:0 (0.0 B)

Here you see the wired interface "eth0" has IPv4 address "172.17.255.192", which was given by the dhcp server on the LAN. The wifi "wlan0" interface has no IP address, because the /etc/wpa_supplicant/wpa_supplicant.conf referred to in /etc/networking/interfaces is missing. That's ok.

2. Setup bridging
Make two (or more) interfaces behave as if they were plugged into a physical switch.

Start with adding network interface bridging capability to the Pi 3. The raspbian package to install is called "bridge-utils":

Code: Select all

admin@berck:~ $ sudo apt-get install bridge-utils
Reading package lists... Done
Building dependency tree       
Reading state information... Done
The following NEW packages will be installed:
  bridge-utils
0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.
Need to get 32.1 kB of archives.
After this operation, 60.4 kB of additional disk space will be used.
Get:1 http://mirrors.ircam.fr/pub/raspbian/raspbian jessie/main armhf bridge-utils armhf 1.5-9 [32.1 kB]
Fetched 32.1 kB in 0s (101 kB/s)        
Selecting previously unselected package bridge-utils.
(Reading database ... 70524 files and directories currently installed.)
Preparing to unpack .../bridge-utils_1.5-9_armhf.deb ...
Unpacking bridge-utils (1.5-9) ...
Processing triggers for man-db (2.7.0.2-5) ...
Setting up bridge-utils (1.5-9) ...

Once installed you have access to a new command, "brctl":

Code: Select all

admin@berck:~ $ brctl show
bridge name	bridge id		STP enabled	interfaces

OK, nothing to see here yet.

Next we modify the networking configuration to bridge the wireless interface "wlan0" and the wired interface "eth0". We want the bridge to manage both interfaces and get the IP address for itself via DHCP.
Start by making a backup copy of file /etc/network/interfaces in case you want to roll back to stock configuration

Code: Select all

admin@berck:~ $ sudo cp -v /etc/network/interfaces /etc/network/interfaces.backup
‘/etc/network/interfaces’ -> ‘/etc/network/interfaces.backup’

You can edit /etc/network/interfaces any way want; I'll use nano:

Code: Select all

admin@berck:~ $ sudo nano /etc/network/interfaces

and change the configuration to this:

Code: Select all

admin@berck:~ $ cat /etc/network/interfaces
# interfaces(5) file used by ifup(8) and ifdown(8)

# Please note that this file is written to be used with dhcpcd
# For static IP, consult /etc/dhcpcd.conf and 'man dhcpcd.conf'

# Include files from /etc/network/interfaces.d:
source-directory /etc/network/interfaces.d

auto lo
iface lo inet loopback

auto eth0
iface eth0 inet manual

auto wlan0
iface wlan0 inet manual

auto br0
iface br0 inet dhcp
bridge-stp on
bridge-maxwait 2
bridge-fd 2
bridge-ports eth0 wlan0

Time for the suicide jump that will cut networking but hopefully return with a new working configuration. Again, run this command from the local console or risk losing connexion with your Pi 3:

Code: Select all

admin@berck:~ $ sudo service networking reload
Warning: Unit file of networking.service changed on disk, 'systemctl daemon-reload' recommended.
admin@berck:~ $ sudo service networking restart
Warning: Unit file of networking.service changed on disk, 'systemctl daemon-reload' recommended.

You're in luck, the network still works. And now it looks like this:

Code: Select all

admin@berck:~ $ ifconfig
br0       Link encap:Ethernet  HWaddr b8:27:eb:01:02:03  
          inet addr:172.17.255.192  Bcast:172.17.255.255  Mask:255.255.0.0
          inet6 addr: fe80::ba27:ebff:fe01:0203/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:225 errors:0 dropped:0 overruns:0 frame:0
          TX packets:143 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:45462 (44.3 KiB)  TX bytes:49855 (48.6 KiB)

eth0      Link encap:Ethernet  HWaddr b8:27:eb:01:02:03  
          inet addr:172.17.255.192  Bcast:172.17.255.255  Mask:255.255.0.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:8042 errors:0 dropped:15 overruns:0 frame:0
          TX packets:3607 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:755414 (737.7 KiB)  TX bytes:412604 (402.9 KiB)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:164 errors:0 dropped:0 overruns:0 frame:0
          TX packets:164 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1 
          RX bytes:15010 (14.6 KiB)  TX bytes:15010 (14.6 KiB)

wlan0     Link encap:Ethernet  HWaddr b8:27:eb:11:12:13  
          UP BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:1 errors:0 dropped:1 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:60 (60.0 B)  TX bytes:0 (0.0 B)

Now the bridge br0 has received the IP address from the DHCP server. It has taken the MAC address of the wired interface eth0, so the DHCP server gave it the same address as before.
EDIT: In fact this doesn't look right. eth0 should not have an address any longer. Instead of running networking restart, reboot if you can.

How is our bridge doing?

Code: Select all

admin@berck:~ $ brctl show
bridge name	bridge id		STP enabled	interfaces
br0		8000.b827eb010203	yes		eth0

Hum, wait. Where is wlan0?
Well, since wlan0 is a wifi interface, bridging is not allowed (by the Wi-Fi standard body) unless the interface is in Access Point mode. It's not yet, so it wasn't included to the bridge. That's ok, we'll see to that next.

3. Setup the Access Point
Allow wireless devices to connect to the Pi 3 and then obtain an address on the LAN through the wireless<->ethernet bridge.

First we need to install the "hostapd" package:

Code: Select all

admin@berck:/etc/hostapd $ sudo apt-get install hostapd
Reading package lists... Done
Building dependency tree       
Reading state information... Done
The following NEW packages will be installed:
  hostapd
0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.
Need to get 459 kB of archives.
After this operation, 1,164 kB of additional disk space will be used.
Get:1 http://mirrors.ircam.fr/pub/raspbian/raspbian jessie/main armhf hostapd armhf 1:2.3-1+deb8u3 [459 kB]
Fetched 459 kB in 0s (1,228 kB/s)
Selecting previously unselected package hostapd.
(Reading database ... 70530 files and directories currently installed.)
Preparing to unpack .../hostapd_1%3a2.3-1+deb8u3_armhf.deb ...
Unpacking hostapd (1:2.3-1+deb8u3) ...
Processing triggers for man-db (2.7.0.2-5) ...
Processing triggers for systemd (215-17+deb8u4) ...
Setting up hostapd (1:2.3-1+deb8u3) ...

Now we create a configuration file for the access point. I'll edit the file with:

Code: Select all

admin@berck:~ $ sudo nano /etc/hostapd/hostapd.conf

This is the final file. It should work with the integrated wifi interface of Pi 3. Peruse hostapd documentation to refine this basic setup:

Code: Select all

admin@berck:~ $ cat /etc/hostapd/hostapd.conf 
# Basic AP parameters
ssid=test
wpa_passphrase=it's good to be the king
interface=wlan0
bridge=br0
channel=1

# WPA 2 PSK
wpa=2
auth_algs=1
wpa_key_mgmt=WPA-PSK
rsn_pairwise=CCMP

# Wifi-N
driver=nl80211
hw_mode=g
ieee80211n=1
ieee80211d=1
country_code=<your_2-letter_country_code>
ieee80211h=1
# I'm sorry, I don't know if the right stanza is
# wme_ or wmm_ so I include both...
wme_enabled=1
wmm_enabled=1

Now make sure file /etc/default/hostapd contains the uncommented line

Code: Select all

DAEMON_CONF="/etc/hostapd/hostapd.conf"

(in other words, remove the sharp sign # in front of this line if there is one)

And now a second leap of faith. Reboot the machine, and once you're logged in again you should see this

Code: Select all

admin@berck:~ $ ifconfig br0
br0       Link encap:Ethernet  HWaddr b8:27:eb:01:02:03  
          inet addr:172.17.255.192  Bcast:172.17.255.255  Mask:255.255.0.0
          inet6 addr: fe80::ba27:ebff:fe01:0203/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:2766 errors:0 dropped:0 overruns:0 frame:0
          TX packets:622 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:563003 (549.8 KiB)  TX bytes:87940 (85.8 KiB)

admin@berck:~ $ pidof hostapd
1051
admin@berck:~ $ brctl show
bridge name	bridge id		STP enabled	interfaces
br0		8000.b827eb010203	yes		eth0
						                    wlan0

We have our bridge working, hostapd is running, and lo and behold, the interface wlan0 in AP mode got included to the bridge.

Now grab a wireless device, point it to the AP "test", input the password "it's good to be the king" and it should get an address on the LAN, just as another machine.

[Ghandi]

Would this be suitable to configure in this way for a Tor relay?

I have tried to configure this so many times tinkering with different options.

I tried the adafruit one, but that was more geared for Pi with an external Wifi dongle.. I can get to the same point as the OP and get the same error message, where i can run the command to test hostadp and it is enabled, but i reboot and it is inactive again.

Using the frillip guide, i get mixed results. I had to set the ssid as the hostname or hostnamed fails to start. The when i try to put dnsmasq on, it fails to start as well.

in the end, i tried to use, hostapd but use isc-dhcp-server.

here are the steps taken so far, i thought I had it working, but as soon as i tried to install tor, it all went wrong and lost connectivity to the AP.

Code: Select all

#install hostapd and isc-dhcp server
sudo apt-get install hostapd isc-dhcp-server

sudo nano /etc/dhcpcd.conf
#assign static address to dhcpcd.conf
interface wlan0  
    static ip_address=172.24.1.1/24

sudo ifdown wlan0

sudo nano /etc/network/interfaces
#blank out all wlan0 in /etc/network/interfaces
#allow-hotplug wlan0  
#iface wlan0 inet manual  
#    wpa-conf /etc/wpa_supplicant/wpa_supplicant.conf

sudo nano /etc/dhcp/dhcpd.conf
#hash out domain name options
#option domain-name "example.org";
#option domain-name-servers ns1.example.org, ns2.example.org;
# remove hash/uncomment #authoritive
authoritative;

#add at bottom of dhcpcd.con file
subnet 172.24.1.0 netmask 255.255.255.0 {
range 172.24.1.10 172.24.1.50;
option broadcast-address 172.24.1.255;
option routers 172.24.1.1;
default-lease-time 600;
max-lease-time 7200;
option domain-name "local";
option domain-name-servers 8.8.8.8, 8.8.4.4;
}

sudo nano /etc/default/isc-dhcp-server
INTERFACES="wlan0"


sudo nano /etc/hostapd/hostapd.conf
interface=wlan0
driver=nl80211
ssid=raspberrypi
country_code=GB
hw_mode=g
channel=6
macaddr_acl=0
#deny_mac_file=/etc/hostapd/hostapd.deny
auth_algs=1
wpa=2
wpa_passphrase=raspberry
wpa_key_mgmt=WPA-PSK
wpa_pairwise=TKIP 
rsn_pairwise=CCMP

sudo nano /etc/default/hostapd
DAEMON_CONF="/etc/hostapd/hostapd.conf"

sudo nano /etc/sysctl.conf
net.ipv4.ip_forward=1

sudo sh -c "echo 1 > /proc/sys/net/ipv4/ip_forward"

sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE  
sudo iptables -A FORWARD -i eth0 -o wlan0 -m state --state RELATED,ESTABLISHED -j ACCEPT  
sudo iptables -A FORWARD -i wlan0 -o eth0 -j ACCEPT

sudo sh -c "iptables-save > /etc/iptables.ipv4.nat"

sudo nano /lib/dhcpcd/dhcpcd-hooks/70-ipv4-nat
iptables-restore < /etc/iptables.ipv4.nat 

sudo service hostapd start
sudo service isc-dhcp-server start

[epoch1970]

Would this be suitable to configure in this way for a Tor relay?

I don't know what a Tor relay is.

This thread (or at least my last post) is about making a wireless Access Point out of the Pi. Like a real-life AP you can buy off the shelf: plug an ethernet cable on one side, and start using wifi instead of using a cable on your computers. It's not a router, it doesn't know anything about routing, etc.
Every services come from the wired network (your home router) and goes through the Pi directly to your wireless devices. The Pi is transparent (a bridge is transparent).

[Ghandi]

Thanks for the response.

You have answered my question and don't think bridging will work.

I guess i need to set this up where i need the access point to act like what frillip describes.. ill keep plugging away and if im stuck ill post a new topic