【LINUX】【bridge】一些有价值的 LINUX - bridge(brctl) 参考

一些有价值的 LINUX - bridge(brctl) 参考

brctl 基本用法

（原）LINUX 网桥设置 MAC 地址时的行为

网桥br0 解释和介绍

(原) 网桥br0

注：该文中的 ?

“LINUX 内核只支持以太网接口（interface）的桥接” 现在描述不准确！
还支持做 AP 的 wireless interface （可以在下一个参考中找到）。

How to bridge a wireless interface with another wireless interface (both on the same computer)?

这篇提问来自一位已经对 LINUX bridge 有了一定知识的用户的提问。
也就是说提问的问题都比较深入 LINUX bridge 的特性（而不是入门级的对 LINUX bridge 如何使用的问题）。
其下的回答也相当专业。

原文 ?

Q

Ubuntu 14.04

Basically I am trying to accomplish the following setup -

wireless internet —> wlan0 of Ubuntu computer “bridged to” wlan1 of same Ubuntu computer —> device with wifi

The reason for this setup is that the wireless internet is a WPA2 Enterprise network which my device with wifi cannot connect to. (The device with wifi also cannot connect to peer-to-peer networks or ad-hoc networks.) Also, the wireless internet source has no whitelist / blacklist and therefore there is no issue with it seeing the device’s MAC address (if necessary), and no issue with it assigning an IP address to the device (if necessary). It is the device that has an issue with WPA2 Enterprise authentication.

[EDIT - As the device cannot successfully authenticate, the wireless internet source is NOT likely to assign an IP address to the device, and also likely to take issue with seeing the device’s MAC address.]

wlan0 is an Intel wireless chipset / interface which cannot be set to either access point mode or master mode, and therefore is used to connect to the WPA2 Enterprise internet source.

wlan1 is to be set to access point mode.

Obviously, the “bridge” between wlan0 and wlan1 is not meant to be wireless, as both are on the same computer.

(1) I believe brctl cannot bridge a wireless interface (wlan0) to another wireless interface (wlan1). Is this correct?

(2) If brctl cannot be used, can I still use hostapd?

(3) If brctl cannot be used, what should I be looking for to accomplish the setup described above?

(4) Would any of the following be a part of the solution to my problem - (a) dnsmasq to serve DHCP (b) hostapd © static IP address (for wlan1 ???) (for the device connected to wlan1 ??) (d) NAT (Network Address Translation) (e) iptables (f) IP Masquerade (g) sudo iw set dev wlan0 4addr on (h) WDS (wireless distribution system) (i) IP Forwarding ?

Thank you.

---

A

(1) I believe brctl cannot bridge a wireless interface (wlan0) to another wireless interface (wlan1). Is this correct?

The requirement here is that all interfaces must be able to send packets with any source MAC address, and receive packets with any destination MAC (not just the device’s own).

Wi-Fi AP interfaces can be bridged just fine (most “wireless routers” in fact have a plain Linux bridge between AP and Ethernet). Station-mode interfaces, however, cannot. So you can bridge wlan1 but not wlan0.

There’s a way around it – the “4addr” mode aka “WDS” mode, which adds an extra MAC address field to Wi-Fi frames. You can enable it via iw, as long as your Wi-Fi driver supports it. Once enabled, you will be able to bridge wlan0 as well.

However, for security reasons, many APs don’t allow 4addr mode by default. (Some have a general toggle, some have a MAC-based whitelist.) Will it work with your university AP? Try it and see.

(Another workaround is “arpnat” – like NAT but applied to MAC addresses – but it can confuse DHCP servers, and it’s not supported by regular Linux anyway. Some APs, like PicoStation, support it in station mode.)

(2) If brctl cannot be used, can I still use hostapd?

Depends on your Wi-Fi driver. Most of them should support AP mode nowadays, but not all do. Use iw phy0 info, iw phy1 info to find out.

(3) If brctl cannot be used, what should I be looking for to accomplish the setup described above?

The most common alternative approach would be IP NAT (masquerading) using iptables.

In some cases, regular routing (without NAT) would also work.

(4) Would any of the following be a part of the solution to my problem
(a) dnsmasq to serve DHCP (b) hostapd © static IP address (for wlan1 ???) (for the device connected to wlan1 ??) (d) NAT (Network Address Translation) (e) iptables (f) IP Masquerade (g) sudo iw set dev wlan0 4addr on (h) WDS (wireless distribution system) (i) IP Forwarding ?

yes, no, no, yes, maybe, maybe, what, uh, are you just throwing assorted terms here?

Comments

The internet source disconnects wlan0 when wlan0 has 4addr turned on. I believe this means that the 4addr (WDS) suggestion will not work for me. Please correct me if I am wrong. I will pursue the IP-NAT-masquerading-iptables proposal, but just a quick check - what about ebtables instead? – sean Oct 14 '15 at 12:27

[Solved] iptables in place of brctl works. Issue closed. – sean Oct 16 '15 at 6:47

@sean can you please expand on your iptable solution? I tried this, but with ethernet for the 2nd interface, and I can’t ping beyond the hardware wireless router. – James Hirschorn Jan 7 '17 at 20:03