Raspberry Pi 3B connecting to two WiFi networks simultaneously

[RaspiFan2019]

Hello,

I'm trying to build a device that has a RPi 3B+ acting as a private, local network hotspot. A RPi Zero W will be connected to it for video streams, while a RPi 3B will also be connected for a voice assistant. I want to be able to connect the 3B to both the 3B+ and the internet at the same time - sending web requests over a USB WiFi adapter and relaying commands within the local network.

Is it possible to do this? I have found some posts here discussing it, but none have given a clear answer.

Additionally, if it were possible, how would I ensure that only web requests go through the USB adapter (probably by restricting it to ports 80, 53, and 443).

The 3B+ uses hostapd and dnsmasq.

[bzt]

Hi,

As for the two WiFis, google is your friend. Here are some links I've found with the keywords "wpa_supplicant multiple wifi simultaneously":
https://raspberrypi.stackexchange.com/q ... -a-wifi-ap (full example on how to do what you want)
viewtopic.php?t=49283 (this is more about having two WiFi adapters on RPi, but could be useful)

About the restrictions, yes, you'll need iptables for that. The ports you've listed are fine (http, dns, https; just keep in mind that http+https are tcp, while dns could be udp too), you should allow those on the WAN interface only (which will be your USB WiFi I think). But also I'd recommend to allow RELATED and ESTABLISHED packages on top of the rule chain to speed up things. In your case use -i and -o arguments with the WAN wlan interface (which should be wlan1 most likely, but depending on the WiFi chip, could be ath0 etc. Connect your USB dongle then type "dmesg" to figure the interface name out). Just to clearify, you need RELATED and ESTABLISHED on the INPUT chain, and dport filtering on the OUTPUT chain. This way you cannot connect to your RPi from the internet (safe), but you'll be able to access websites from the RPi, and related responses will be allowed to come in.
For the LAN interface (wlan0, the built-in WiFi chip) you should allow everything with "-j ACCEPT", so that there would be no restrictions on your LAN.

Cheers,
bzt

[RaspiFan2019]

Hello bzt,

Thank you! That seems to work.