How to build a wireless 802.11b Access Point using FreeBSD

HOME -- Tools -- Features -- Mirrors -- IRC -- Help

U N I X C I R C L E

Greetings... 80.72.64.115 Wget/1.8.2 Logged...

January 31, 2004 12:25:20 pm

by Hoang Q. Tran

It is really easy to build a wireless access point using FreeBSD. Here are the following steps:

Introduction

A typical home network with broadband connection:

               {Internet}
                   |
              -------------
              | Cable/DSL |
              | Modem     |
              -------------
                   |
               ----------
               |  fw/   |
               | router |
               ----------
                   | 192.168.1.1
               ----------            <..............>
               | Switch | ----- fxp0 .   FreeBSD    .
               ----------        .5  . Access Point .
                   |                 <..............>
              -----------                   wi0
              ^    ^    ^                  ^   ^
              pc1 pc2  pc3             ^^^^     ^^^^
              .2  .3   .4             ^             ^
                                   MA101            wi0
                                    .6              .7
                                <....^.....>    <....^.....>
                                . windows  .    . openbsd  .
                                .   wifi   .    .   wifi   .
                                .  client  .    .  client  .
                                <..........>    <..........>

What you need

Before you head out to get your wireless pci adapter or pcmcia, make sure it uses one of the following chipsets:

- Lucent Hermes, Intersil PRISM-II, Intersil PRISM-2.5, Symbol Spectrum24

However, only Intersil PRISM-II and Intersil PRISM-2.5 support hostap (access point mode).

FreeBSD access point:

- Netgear MA311 PCI Adapter (PRISM-2.5 chipset with support for access point mode)
- Intel Management Pro/100+

Windows wireless client:

- Netgear MA101 USB Adapter

OpenBSD wireless client:

- Dlink DWL-520 (Intersil PRISM2.5 Mini-PCI WLAN)

Recompile the kernel

Update your kernel file with the following and recompile the kernel:

options         BRIDGE          # Bridge to ethernet world
device          miibus          # MII bus support
device          fxp             # Intel Management Pro/100+
device          wi              # Driver for Lucent Hermes, Intersil PRISM-II,
                                # PRISM-2.5, and Symbol Spectrum24 chipsets

Setup access point

For the wireless network, we'll use 128-bit key length to authenticate and wired equivalent privacy (WEP) to encrypt the connection between the access point and wireless client.

Create a shell script /usr/local/etc/rc.d/ap.sh with the following configurations:

1. Configure the access point mode and call it my_wifi as the network name (ssid):

# ifconfig wi0 inet up ssid my_wifi media DS/11Mbps mediaopt hostap

2. Turn on Wired Equivalent Privacy:

# wicontrol -e 1

3. Define four 128-bit keys. An easy way to generate four random 26 hex digits long is to use openssl and hexdump: openssl rand 13|hexdump -e '"%02x"'

# wicontrol -k 0x466e4545657e295921b66c1b7d -v 1
# wicontrol -k 0xda6a16264596813fd5cdffc3e3 -v 2
# wicontrol -k 0xbb8d2c379c80eebaa4d20355e7 -v 3
# wicontrol -k 0x2b8f1735302c82c5d20ca2cb5e -v 4

4. Specify key 1 to be used to encrypt transmitted packets:

# wicontrol -T 1

5. Choose one of the three non overlapping channels 1,6,11:

# wicontrol -f 6

6. Define station name FreeBSD_AP:

# wicontrol -s "FreeBSD_AP"

7. Bridge wireless to ethernet world:

# sysctl net.link.ether.bridge=1
# sysctl net.link.ether.bridge_cfg="wi0 fxp0"
# sysctl net.inet.ip.forwarding=1

8. Verify that the access point is up and ready to go:

# ifconfig
fxp0: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
        inet 192.168.1.30 netmask 0xffffff00 broadcast 192.168.1.255
        inet6 fe80::290:27ff:fe74:9530%fxp0 prefixlen 64 scopeid 0x1
        ether 00:90:27:74:95:30
        media: Ethernet autoselect (100baseTX <full-duplex>)
        status: active
wi0: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
        inet6 fe80::209:5bff:fe11:c623%wi0 prefixlen 64 scopeid 0x2
        ether 00:09:5b:11:c6:23
        media: IEEE 802.11 Wireless Ethernet DS/11Mbps <hostap>
        status: associated
        ssid my_wifi 1:my_wifi
        stationname "FreeBSD_AP"
        channel 6 authmode OPEN powersavemode OFF powersavesleep 100
        wepmode MIXED weptxkey 1
        wepkey 1:128-bit wepkey 2:128-bit wepkey 3:128-bit wepkey 4:128-bit

Setup wireless clients

On the wireless client side, simply join the wireless network using the key and use WEP.

Windows wireless client:

Setup the IP Address as 192.168.1.6 netmask 0xffffff00 and DNS server. Then, configure the wireless settings using the Netgear Utility:

- Configuration tab->Network Name: my_wifi
- Security tab->Check `Enable Encryption (Web Key). Key length 128-Bit. Enter key1-4 and select key1 as default
- Click OK

OpenBSD wireless client:

Create /etc/hostname.wi0 with network name, WEP key and IP address:

/etc/hostname.wi0
!wicontrol \$if -n my_wifi -p 1 -k 0x466e4545657e295921b66c1b7d -e 1
inet 192.168.1.7 255.255.255.0

You're now ready to surf the internet using your wireless connection via the broadband cable/dsl modem.

Hostap and firmware update

From the wi man page:

The host-based access point mode on the Intersil PRISM cards has bugs when used with firmware versions prior to 0.8.3 and is completely unusable with firmware versions 0.7.5 and 1.4.0-1.4.2.

Apparently, firmware 1.4.9 and 1.5.6 are known to work reliably.

Security

WEP is crackable and have known to be insecure. An alternative is to use IPsec to protect sensitive data.

Acknowledgement

Thanks goes to Bill Paul wpaul@freebsd.org for writing a great wi(4) driver.

Reference

man wi(4),wicontrol(8)

last update: July 27, 2003