From M1Research

(Difference between revisions)

Revision as of 10:16, 12 July 2008

WiFi Hardware

As we are going build WPA protected Access Point it's required authorization daemon supports our hardware. Authorization software based on hostapd. As seen from hostapd's home page it support chipsets/drivers:

Host AP driver for Prism2/2.5/3
madwifi (Atheros ar521x)
Prism54.org (Prism GT/Duette/Indigo)

After some research on our local PC components market we choose D-link DWA-520 that is Atheros chipset based:

[root@dev-1 ~]# lspci -vvv
--skipped--
01:0b.0 Ethernet controller: Atheros Communications, Inc. AR5212/AR5213 Multiprotocol MAC/baseband processor (rev 01)
        Subsystem: D-Link System Inc Unknown device 3a73
        Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV+ VGASnoop- ParErr- Stepping- SERR+ FastB2B- DisINTx-
        Status: Cap+ 66MHz- UDF- FastB2B+ ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
        Latency: 168 (2500ns min, 7000ns max), Cache Line Size: 32 bytes
        Interrupt: pin A routed to IRQ 23
        Region 0: Memory at ff8f0000 (32-bit, non-prefetchable) [size=64K]
        Capabilities: [44] Power Management version 2
                Flags: PMEClk- DSI- D1- D2- AuxCurrent=375mA PME(D0-,D1-,D2-,D3hot-,D3cold-)
                Status: D0 PME-Enable- DSel=0 DScale=2 PME-
        Kernel driver in use: ath_pci
        Kernel modules: ath_pci
--skipped--

and supported by madwifi drivers.

Generic Installation

Generic installation steps:

install WiFi pci board
install additional ethernet adapter (we want 2 adapters: 1st WAN, 2nd LOCAL LAN)
install minimal Fedora Core 8 installation
update all installed Fedora packeges
install required packages for building madwifi drivers and hostapd:
- gcc
- openssl-devel
- kernel package development (in my case kernel-devel-2.6.25.9-40.fc8)
- dhcp
- bind, bind-chroot
- bridge-utils
download to /usr/local/src madwifi driver and hostapd source code:
- madwifi-0.9.4.tar.gz
- hostapd-0.6.3.tar.gz

Building/configuring driver

Unpack madwifi-0.9.4.tar.gz to /usr/local/src:

[root@dev-1 ~]# cd /usr/local/src
[root@dev-1 src]# gzip -cd madwifi-0.9.4.tar.gz | tar xf -

Goto source code directory, build and install:

[root@dev-1 src]# cd madwifi-0.9.4
[root@dev-1 madwifi-0.9.4]# make
Checking requirements... ok.
Checking kernel configuration... ok.
make -C /lib/modules/2.6.25.9-40.fc8/build SUBDIRS=/usr/local/src/madwifi-0.9.4 modules
make[1]: Entering directory `/usr/src/kernels/2.6.25.9-40.fc8-i686'
  CC [M]  /usr/local/src/madwifi-0.9.4/ath/if_ath.o
--skipped--
gcc -o ath_info -g -O2 -Wall ath_info.c
make[1]: Leaving directory `/usr/local/src/madwifi-0.9.4/tools'
[root@dev-1 madwifi-0.9.4]# make install

Remove old ath5k driver:

[root@dev-1 madwifi-0.9.4]# rm -f -r -d /lib/modules/2.6.25.9-40.fc8/kernel/drivers/net/wireless/ath5k
[root@dev-1 madwifi-0.9.4]# depmod -a

Check /etc/modprobe.conf contains correct options for new driver and wlan0 associated with ath_pci driver:

alias eth0 e100
alias eth0 eth1
#alias wlan0 ath5k
alias wlan0 ath_pci
options ath_pci autocreate=ap
alias scsi_hostadapter libata
alias scsi_hostadapter1 ata_piix

Network configuration

Setup ethernet adaptor eth0 for WAN interface and bridge (eth1 + wlan0) for local network.

/etc/sysconfig/network-scripts/ifcfg-br0

DEVICE=br0
TYPE=Bridge
BOOTPROTO=static
IPADDR=192.168.1.1
NETMASK=255.255.255.0
ONBOOT=yes
DELAY=0
STP=off

/etc/sysconfig/network-scripts/ifcfg-eth0

DEVICE=eth0
BOOTPROTO=static
BROADCAST=10.1.255.255
IPADDR=10.1.5.190
NETMASK=255.255.0.0
NETWORK=10.1.0.0
ONBOOT=yes

/etc/sysconfig/network-scripts/ifcfg-eth1

DEVICE=eth1
TYPE=ETHER
BRIDGE=br0
ONBOOT=yes

/etc/sysconfig/network-scripts/ifcfg-wlan0

DEVICE=wlan0
BRIDGE=br0
ONBOOT=yes
MODE=master
ESSID="home-home"

Please note that our AP network ESSID we setted to home-home.

Network services configuration

DHCP

/etc/dhcpd.conf:

ddns-update-style interim;
ignore client-updates;

subnet 192.168.1.0 netmask 255.255.255.0 {

# --- default gateway
        option routers                  192.168.1.1;
        option subnet-mask              255.255.255.0;

        option nis-domain               "domain.org";
        option domain-name              "domain.org";
        option domain-name-servers      192.168.1.1;

        option time-offset              -18000; # Eastern Standard Time
#       option ntp-servers              192.168.1.1;
#       option netbios-name-servers     192.168.1.1;
# --- Selects point-to-point node (default is hybrid). Don't change this unless
# -- you understand Netbios very well
#       option netbios-node-type 2;

        range dynamic-bootp 192.168.1.128 192.168.1.254;
        default-lease-time 21600;
        max-lease-time 43200;

        # we want the nameserver to appear at a fixed address
        host ns {
                next-server marvin.redhat.com;
                hardware ethernet 12:34:56:78:AB:CD;
                fixed-address 207.175.42.254;
        }
}

DNS

/etc/named.conf:

options {
//      listen-on port 53 { 127.0.0.1; };
        listen-on-v6 port 53 { ::1; };
        directory       "/var/named";
        dump-file       "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        memstatistics-file "/var/named/data/named_mem_stats.txt";
        allow-query     { any; };
        recursion yes;
};

logging {
        channel default_debug {
                file "data/named.run";
                severity dynamic;
        };
};

zone "." IN {
        type hint;
        file "named.ca";
};

include "/etc/named.rfc1912.zones";

FireWall

/etc/sysconfig/iptables:

*nat
-A POSTROUTING -o eth0 -j MASQUERADE
-A POSTROUTING -o ppp0 -j MASQUERADE
COMMIT

*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:RH-Firewall-1-INPUT - [0:0]
-A FORWARD -i br0 -j ACCEPT
-A INPUT -i br0 -j ACCEPT
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT
-A RH-Firewall-1-INPUT -p 50 -j ACCEPT
-A RH-Firewall-1-INPUT -p 51 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp --dport 5353 -d 224.0.0.251 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22  -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
COMMIT

/etc/sysctl.conf:

--skipped--
# Controls IP packet forwarding
net.ipv4.ip_forward = 1
--skipped--

hostapd

building

Unpack source code to /usr/local/src direcory and goto direcotry:

[root@dev-1 src]# gzip -cd hostapd-0.6.3.tar.gz | tar xf -
[root@dev-1 src]# cd hostapd-0.6.3
[root@dev-1 hostapd-0.6.3]# cd hostapd
[root@dev-1 hostapd]#

Copy build config template file to appropriate name:

[root@dev-1 hostapd]# cp defconfig .config

Modify config file .config in such way (this is diff file):

--- defconfig   2008-02-23 04:45:24.000000000 +0200
+++ .config     2008-07-12 12:55:53.000000000 +0300
@@ -9,6 +9,9 @@
 # be modified from here. In most cass, these lines should use += in order not
 # to override previous values of the variables.

+CONFIG_DRIVER_MADWIFI=y
+CFLAGS += -I/usr/local/src/madwifi-0.9.4
+
 # Driver interface for Host AP driver
 CONFIG_DRIVER_HOSTAP=y</code>

Make and install:<pre>[root@dev-1 hostapd]# make
[root@dev-1 hostapd]# make install

configuration

Create directory /etc/hostapd

Create file /etc/hostapd/hostapd.conf:

interface=wlan0
bridge=br0
driver=madwifi
logger_syslog=-1
logger_syslog_level=2
logger_stdout=-1
logger_stdout_level=2
debug=0
dump_file=/tmp/hostapd.dump
ctrl_interface=/var/run/hostapd
ctrl_interface_group=0
ssid=home-home
auth_algs=3
eapol_key_index_workaround=0
eap_server=0
wpa=3
wpa_psk_file=/etc/hostapd/wpa_psk
wpa_key_mgmt=WPA-PSK
wpa_pairwise=CCMP</code>

Please note: <code>ssid=home-home</code> should define the same SSID as you defined during interface configuration, <code>wpa_pairwise=CCMP</code> mean that AES used for key management.

Create file <code>/etc/hostapd/wpa_psk</code>:<pre>00:00:00:00:00:00 PRIVETPRIVETPRIVETPRIVETPRIVETPRIVETPRIVETPRIVETPRIVETPRIVET!!!

where:

00:00:00:00:00:00 mean that any MAC address accepted
PRIVETPRIVET... is passphrase.

Original hostapd.wpa_psk says:

# List of WPA PSKs. Each line, except for empty lines and lines starting
# with #, must contain a MAC address and PSK separated with a space.
# Special MAC address 00:00:00:00:00:00 can be used to configure PSKs that
# anyone can use. PSK can be configured as an ASCII passphrase of 8..63
# characters or as a 256-bit hex PSK (64 hex digits).
00:00:00:00:00:00 secret passphrase
00:11:22:33:44:55 another passphrase
00:22:33:44:55:66 0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef
00:00:00:00:00:00 another passphrase for all STAs

Set correct permissions to key file /etc/hostapd/wpa_psk:

[root@dev-1 hostapd]# chmod 600 /etc/wpa_psk

Modify /etc/rc.d/rc.local to enable hostapd daemon startup:

--skipped--
# run hostap daemon
/usr/local/bin/hostapd -B /etc/hostapd/hostapd.conf
--skipped--

Testing

Now you may reboot pc.

After system starts login and check:

WiFi driver loaded correctly:
hostapd started

Try to connect from another pc throw WiFi to AP home-home with listed above credentials.

AP FC8

From M1Research

Revision as of 10:16, 12 July 2008

Contents

WiFi Hardware

Generic Installation

Building/configuring driver

Network configuration

Network services configuration

DHCP

DNS

FireWall

hostapd

building

configuration

Testing

Views

Personal tools

Navigation

Search

Toolbox