Pi AP for LAN, but use iPhone cellular for internet gateway

[johnnyJE]

I have a photo gallery app served from my Pi3. Users download photos and post them to social media, so we need both LAN and WAN access.

My Pi3 running Stretch Lite joins my iPhone personal hotspot or other WiFi network. When I use the app with my friends on-the-go, they must join my iPhone personal hotspot, which devours my phone data and battery.

Thanks to SurferTim I set up hostapd, dhcpcd, dnsmasq etc on Stretch Lite but never worked out the networking details I want, so I've been running the Pi3 in client mode with my iPhone personal hotspot and just charging it more.

I need a way to have the Pi create a WiFi LAN for us to join, but have web requests go via our individual cellular network interfaces. I am a web developer, so I don't have great networking knowledge and I sense that I have a blind spot here with knowing the name of the problem I am trying to solve. Here's the behavior I want:
1. if ethernet: do traditional hostapd access point things to bridge eth0 to wlan0
2. if wifi network: join that and just be on that network and wait for other hosts on the LAN
3. if no ethernet, no wifi: do hostapd and the networking magic to let us use our individual cellular interfaces

I've seen some people posting about something that sounds like the same thing, so I think it may have to do with gateways and DNS.
https://raspberrypi.stackexchange.com/q ... smartphone
https://apple.stackexchange.com/questio ... 060#207060

Is it possible to make web requests go via cellular, while still allowing LAN access via the avahi hostname? Please help a networking noob.

[epoch1970]

Here's the behavior I want:
1. if ethernet: do traditional hostapd access point things to bridge eth0 to wlan0
2. if wifi network: join that and just be on that network and wait for other hosts on the LAN
3. if no ethernet, no wifi: do hostapd and the networking magic to let us use our individual cellular interfaces

1. Is bridged AP mode without local DHCP server (the LAN provides)
2. Is wifi client mode (requires SSID and password)
3. Is routed (isolated) AP mode

With a screen and keyboard, switching from 1 config set to another should work.
In automatic/headless mode nobody does that, AFAIK. Auto-detection wouldn't be reliable and wifi client mode requires the SSID and password in advance (chicken and the egg problem). It's going to be "complicated" as you need some sort of side channel for configuration and control.

PS: On iOS if you want wifi + Internet via 3G/4G, add "dhcp-option=3" to dnsmasq config. This configures it not to send a default gateway. Cellular will be used to access the Internet. You probably also want "dhcp-option=6" to avoid configuring a local DNS server. (link). I don't think this trick works with Android clients.

[SurferTim]

I've done that in a way. The online docs on the RPi site have been changed to my docs now.
https://www.raspberrypi.org/documentati ... s-point.md

You should have used the standalone network with a second wifi device as a client (I use a usb wifi module). NAT, not a bridge.

By default, the ethernet interface will have priority, so if it is up, the RPI will use it.
If the ethernet interface goes down, the RPi will revert to the usb wifi device for internet.
If neither is up, you can still use the localnet.

The ethernet connection must fail at the router. If the connection fails past that, the RPi will have no way to determine that without developing a connection test app to bring the ethernet interface up and down.

[johnnyJE]

PS: On iOS if you want wifi + Internet via 3G/4G, add "dhcp-option=3" to dnsmasq config. This configures it not to send a default gateway. Cellular will be used to access the Internet. You probably also want "dhcp-option=6" to avoid configuring a local DNS server. (link). I don't think this trick works with Android clients.

Thank you so much. This probably saved me a few hours of googling and debugging. I am going to try this as soon as I get home to my Pi.

With a screen and keyboard, switching from 1 config set to another should work.
In automatic/headless mode nobody does that, AFAIK. Auto-detection wouldn't be reliable and wifi client mode requires the SSID and password in advance (chicken and the egg problem). It's going to be "complicated" as you need some sort of side channel for configuration and control.

I am not worried about the chicken-and-egg problem because I deploy a wpa_supplicant.conf to the pi with the wifi networks I want.

My side-channel is a web form I already have at /admin to submit a string to the server to clear out parts of the database and filesystem. If I really wanted to I could make this take arbitrary data and run arbitrary code on the pi. I think my method of control here is actually just taking down my iPhone personal hotspot and re-starting the pi, which it will do as soon as I disconnect my USB SD card reader from the Pi.

Fortunately the default behavior I got when setting up wpa_supplicant and hostapd was for the Pi to fall into client mode after startup when there was wifi, so the hostapd would be blocked—I'm assuming—from getting started. I think if I do the dnsmasq configuration you mentioned I'll be set.

I think I am close to the solution and I will report back here when I find more information

[johnnyJE]

I've done that in a way. The online docs on the RPi site have been changed to my docs now.
https://www.raspberrypi.org/documentati ... s-point.md

You should have used the standalone network with a second wifi device as a client (I use a usb wifi module). NAT, not a bridge.

By default, the ethernet interface will have priority, so if it is up, the RPI will use it.
If the ethernet interface goes down, the RPi will revert to the usb wifi device for internet.
If neither is up, you can still use the localnet.

The ethernet connection must fail at the router. If the connection fails past that, the RPi will have no way to determine that without developing a connection test app to bring the ethernet interface up and down.

Thanks for doing the work to update this documentation. I used your fork on GitHub in my initial setup and it was critical.

[johnnyJE]

@epoch1970, the dhcp-option=3 worked exactly as intended. I've committed this now do my AP deployment script! Thank you so much

@SurferTim, Thanks again. I made my first PR to the raspi documentation after reading your access-point PR.

[Noel Hibbard]

dhcp-option=3 does the trick for routing internet traffic over cell and local traffic over WiFi. Learned this long ago using the RPi with shairport-sync in my car. But keep in mind the iPhone will ignore your local DNS server if you don't hand out a gateway. I just ran into this on another project. In case anyone else is running into this. Here is a work around for local lookups:
http://carputer/nannies/off = fail
http://carputer.local/nannies/off = success

[epoch1970]

But keep in mind the iPhone will ignore your local DNS server if you don't hand out a gateway.

This is not what I see on iOS 11. If you specify dhcp-option=3, you get no gateway but still the DNS server address is taken into account.

[johnnyJE]

Hi all. Thank you for your past responses!

I have been using this config for a while and it's taken the usefulness of my device to a new level. It's been great with two wireless interfaces to be in AP mode and client mode simultaneously. Friends are starting to pull out their phones and use the gallery which is a great feeling.

I'm ready to take the next steps to improve the user experience by using my internet domain and server to host a welcome page for users that aren't on the wifi, telling them how to join. This site is served with nginx over SSL.

Using a domain name other than pihostname.local also solves the issue of android phones not being able to access the gallery due to lack of avahi/bonjour/zeroconf networking support in chrome.

Once they join the wifi network, I have the same domain to serve locally from the pi3 over SSL. This is great, but in order to do this I've had to take a small step backward in the overall experience: in order to get the domain to resolve, I need to have dnsmasq run a DNS server, so the

Code: Select all

dhcp-option=6 and 3

trick no longer works. The phone now thinks it's connected to the internet because I have a router and DNS, but since there's no upstream connection only gallery.mydomain.com will serve a page and google.com will hang.

My goal is to only provide this gallery.mydomain.com and let other traffic go via the LTE interface.

Here is my question: is this possible? I still consider myself a networking/dnsmask newbie.