Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision		 Previous revision
technical:ppsk-hostapd [2024/04/22 09:13] – systemtechnical:ppsk-hostapd [2024/04/30 08:22] (current) – [Key specific for VLAN] system
Line 8: Line 8:
 ===== File or RADIUS ===== ===== File or RADIUS =====
   * The PPSK function in hostapd gives the user the choice of providing the PPSKs via a file or via RADIUS.   * The PPSK function in hostapd gives the user the choice of providing the PPSKs via a file or via RADIUS.
-  * The option of providing the PPSKs in a text file enables fast and simplified provisioning.+  * The option to provide the PPSKs in a text file enables fast and simplified provisioning.
  
 ------ ------
Line 62: Line 62:
  
 ===== FILE - Advanced PPSK on OpenWrt ===== ===== FILE - Advanced PPSK on OpenWrt =====
-  * The first section dealt with a very basic PPSK implementation.+  * The first section dealt with a very simple PPSK implementation.
   * This section is about more advanced options, including mapping MAC and VLAN to specific keys.   * This section is about more advanced options, including mapping MAC and VLAN to specific keys.
   * You can also visit [[https://forum.openwrt.org/t/individual-per-passphrase-wifi-vlans-using-wpa-psk-file-no-radius-required/161696|this]] forum discussion where most of the information comes from.   * You can also visit [[https://forum.openwrt.org/t/individual-per-passphrase-wifi-vlans-using-wpa-psk-file-no-radius-required/161696|this]] forum discussion where most of the information comes from.
Line 91: Line 91:
 </code>  </code> 
   * A few additional steps are required for the VLAN tagging function of hostapd to work as intended.   * A few additional steps are required for the VLAN tagging function of hostapd to work as intended.
- +  * We need to include a few options to instruct hostapd how to handle the VLANs. 
-<alert type="danger">TO BE COMPLETED</alert> +  * Refer to this snippet from /etc/config/wireless 
 +<code bash> 
 +option wpa_psk_file '/etc/hostapd.wpa_psk' 
 +option vlan_file '/etc/hostapd.vlan' 
 +option vlan_tagged_interface 'eth0' 
 +option vlan_bridge 'br-vlan' 
 +option dynamic_vlan '1' 
 +</code> 
 +  * Then here is an example of hostapd.vlan 
 +<code bash> 
 +# VLAN ID to network interface mapping 
 +1 vlan1 
 +2 vlan2 
 +3 vlan3 
 +4 vlan4 
 +100 guest 
 +# Optional wildcard entry matching all VLAN IDs. The first # in the interface 
 +# name will be replaced with the VLAN ID. The network interfaces are created 
 +# (and removed) dynamically based on the use. 
 +* vlan# 
 +</code> 
 +  * hostapd will create a bridge with each VLAN and automatically create tagged interfaces and make them members of this bridge: 
 +<code bash> 
 +root@OpenWrt:~# brctl show 
 +bridge name     bridge id               STP enabled     interfaces 
 +br-vlan3        8000.4018b1eb3c80       no              vlan3 
 +                                                        eth0.3 
 +br-lan          7fff.4018b1eb3c80       no              eth0 
 +</code>
  
 ------ ------
Line 164: Line 191:
 </code> </code>
   * The difference in behaviour between wpa_psk_radius=2 and wpa_psk_radius=3 occurs when the PPSK is not correct.   * The difference in behaviour between wpa_psk_radius=2 and wpa_psk_radius=3 occurs when the PPSK is not correct.
-  * If wpa_psk_radius=2, hostapd will **NOT** make any follow-up attempts. +  * If wpa_psk_radius=2, hostapd does **NOT** make any follow-up attempts. 
-  * If wpa_psk_radius=3, hostapd will make a follow-up attempt with additional attributes:+  * If wpa_psk_radius=3, hostapd makes a follow-up attempt with additional attributes:
 <code bash> <code bash>
 (10) Received Access-Request Id 49 from 44.88.212.194:47297 to 164.160.89.129:1812 length 337 (10) Received Access-Request Id 49 from 44.88.212.194:47297 to 164.160.89.129:1812 length 337
Line 195: Line 222:
         *  If **wpa_psk_radius=3**, the RADIUS implementation can work with the encrypted value of the PSK specified by the user to perform a hash comparison and is therefore much more flexible. RADIUSdesk supports this option.         *  If **wpa_psk_radius=3**, the RADIUS implementation can work with the encrypted value of the PSK specified by the user to perform a hash comparison and is therefore much more flexible. RADIUSdesk supports this option.
         * However, you will need to modify the /lib/netifd/hostapd.sh file to create the hostapd configuration with this option.         * However, you will need to modify the /lib/netifd/hostapd.sh file to create the hostapd configuration with this option.
 +
 +
 +<alert type="warning">
 +=== Heads-Up ===
 +
 +
 +  * Interestingly, during a troubleshooting session, I left FreeRADIUS running in debug mode for a day or two while sending requests to it from hostapd.
 +  * At some point, it stopped receiving the follow-up request no matter how many times I restarted the access points.
 +  * Finally, out of desperation, I restarted FreeRADIUS and lo and behold, the follow-up requests started coming in again.
 +  * Just a heads up about FreeRADIUS.
 +</alert>
 +
 +
 +==== Reference config ====
 +  * Let us take a look at a simple reference configuration of /etc/config/wireless in which RADIUS-based PPSK is configured.
 +<code bash>
 +config wifi-iface 'zero'
 +        option ifname 'zero0'
 +        option encryption 'psk2'
 +        option acct_interval '300'
 +        option mode 'ap'
 +        option nasid 'a_hosta_53_97'
 +        option acct_server '164.160.89.129'
 +        option acct_secret 'testing123'
 +        option auth_server '164.160.89.129'
 +        option auth_secret 'testing123'  
 +        option network 'lan'
 +        option device 'radio0'
 +        option ssid 'PPSK-APdesk-1'           
 +        option ppsk '1'      
 +        option vlan_naming '0'
 +        option vlan_tagged_interface 'wan'
 +        option vlan_bridge 'br-ex_vlan'
 +        option dynamic_vlan '1'        
 +</code>
 +  * RADIUS-based PPSK implementations usually consist of two components:
 +      * The private key, which is used for authentication on the WiFi network.
 +      * The VLAN assignment, which is usually bound to the private key specified by the user.
 +  * The VLAN assignment is optional. If the RADIUS server has not specified a VLAN in the access acceptance, hostapd does not perform VLAN tagging for the connection of this client.
 +  * If a VLAN is specified in the RADIUS response, the following configuration options determine how hostapd handles the VLAN assignment:
 +<code>
 +option vlan_naming '0'                                                                                                                                                                                                                                                  
 +option vlan_tagged_interface 'wan'                                                                                                                                                                                                                                      
 +option vlan_bridge 'br-ex_vlan'                                                                                                                                                                                                                                         
 +option dynamic_vlan '1' 
 +</code>
 +  * If a client establishes a connection and RADIUS specifies VLAN 100, for example, hostapd dynamically creates the following bridge:
 +<code bash>
 +brctl show
 +bridge name bridge id STP enabled interfaces
 +br-ex_vlan100 7fff.ae7c588014f4 no vlan100
 + zero0.100
 +
 +</code>
 +  * The name  of the bridge is formulated with the value of **vlan_bridge** and the appending of the VLAN number (100).
 +  * The members of this bridge are the tagged WiFi client connection, zero0.100 and vlan100.
 +  * The **vlan100** interface requires a little more explanation. Depending on the value of **vlan_naming**, which can be 0 or 1, the name of the second interface is determined.
 +  * Have a look at this part of the hostapd documentation
 +<code bash>
 +# When hostapd creates a VLAN interface on vlan_tagged_interfaces, it needs
 +# to know how to name it.
 +# 0 = vlan<XXX>, e.g., vlan1
 +# 1 = <vlan_tagged_interface>.<XXX>, e.g. eth0.1
 +#vlan_naming=0
 +</code>
 +  * So if we change our configuration to the **vlan_naming '1'** option, the bridge would look like this:
 +<code bash>
 +brctl show
 +bridge name bridge id STP enabled interfaces
 +br-ex_vlan100 7fff.ae7c588014f4 no wan.100
 + zero0.100
 +
 +</code>
 +  * Remember that for the VLAN to work correctly, you must also provide a DHCP server in the VLAN so that the client receives an IP address after it has authenticated itself in the WiFi network.
 +  * If you do not have such a server in your current network, you can easily do this in MESHdesk and APdesk.
 +  * The details are explained on the corresponding wiki pages.
 +
  • technical/ppsk-hostapd.1713769996.txt.gz
  • Last modified: 2024/04/22 09:13
  • by system