0

On my Debian machine 3 IFs exist:

  • eth0 the local wired network
  • wlan0 running hostapd
  • vlan5 the internet IF to which this machine acts as a gateway for the local netowrk.

eth0 and wlan0 are part of br0. Routing from hosts on the wired local network to other wired hosts or the internet works fine. Routing from clients associated to wlan0 to the internet works fine, but faills towards the wired network. ARP reqests from wireless clients are not answered from br0 even if the requested MAC is known tho br0 (brctl showmacs).

The strange thing ist, that the setup worked up to some time ago. It seems to have stopped working after some Debian kernel updates.

/etc/network/interfaces:

auto lo
iface lo inet loopback

auto eth0
iface eth0 inet manual

auto br0
iface br0 inet static
        address 10.xx.1.3
        netmask 255.255.255.0
        bridge_ports eth0
        bridge_fd 5

iface br0 inet6 static
        address fdxx::3
        netmask 64

mapping hotplug
        script grep
        map wlan0

allow-hotplug wlan0
iface wlan0 inet manual
        hostapd /etc/hostapd/hostapd.conf

auto vlan5
iface vlan5 inet dhcp
        vlan-raw-device eth0
        pre-up /etc/firewall restart

/etc/hostapd.conf:

interface=wlan0
bridge=br0
driver=nl80211
logger_syslog=-1
logger_syslog_level=2
logger_stdout=-1
logger_stdout_level=2
dump_file=/tmp/hostapd.dump
ctrl_interface=/var/run/hostapd
ctrl_interface_group=0
ssid=XXXXX
country_code=XX
ieee80211d=1
hw_mode=a
channel=40
beacon_int=100
dtim_period=2
max_num_sta=255
rts_threshold=2347
fragm_threshold=2346
macaddr_acl=0
auth_algs=1
ignore_broadcast_ssid=0
wmm_enabled=1
wmm_ac_bk_cwmin=4
wmm_ac_bk_cwmax=10
wmm_ac_bk_aifs=7
wmm_ac_bk_txop_limit=0
wmm_ac_bk_acm=0
wmm_ac_be_aifs=3
wmm_ac_be_cwmin=4
wmm_ac_be_cwmax=10
wmm_ac_be_txop_limit=0
wmm_ac_be_acm=0
wmm_ac_vi_aifs=2
wmm_ac_vi_cwmin=3
wmm_ac_vi_cwmax=4
wmm_ac_vi_txop_limit=94
wmm_ac_vi_acm=0
wmm_ac_vo_aifs=2
wmm_ac_vo_cwmin=2
wmm_ac_vo_cwmax=3
wmm_ac_vo_txop_limit=47
wmm_ac_vo_acm=0
eapol_key_index_workaround=0
eap_server=0
own_ip_addr=127.0.0.1
wpa=2
wpa_passphrase=backbone
wpa_key_mgmt=WPA-PSK
wpa_pairwise=TKIP
rsn_pairwise=CCMP

Traffic to the internet is going trough a MASQUERADE rule in the nat POSTROUTING table. Why only traffic to the local wired net is not working from the wireless side of the bridge?

Update 22.11.2015: The problem does not seem to be related with the vlan. When vlan5 is disable at boottime the bridge does not work as well. Packets from the wireless side are passing the bridge, but packets comming from the wired side are dropped somewhere. They do not even appear at the BROUTING chain of ebtables when adding a log rule. The bridge seems to work only in one direction from wlan0 to eth0...

Improve this question
8
  • Do you see the arp requests from wlan0 going out eth0? You don't see the replies, but do you see the requests going out?
    – Paul
    Nov 16, 2015 at 1:20
  • OK, thanks for the hint. The ARP requests seem to arrive at the target and replies are sent back but do not arrive at eth0. A tcpdump on eth0 shows only the outgoing ARP requests towards the wired network. The switch is a NETGEAR GS110TP and seems to have correct MAC address list. I wonder if there is some arp filtering happening somewhere.
    – Xcoder
    Nov 16, 2015 at 21:44
  • Can you check the destination MAC of the ARP replies, and see where they are being sent? It should match eth0 - in which case, something at layer 2 is stopping it - I suppose the switch is the likely candidate.
    – Paul
    Nov 17, 2015 at 3:06
  • The ARP replies from the target machine have the destination MAC of the sender machine, i.e. the wireless-client connected to wlan0. The Netgear switch lists this MAC at the correct port, but the ARP repply does not arrive at br0. Why do you think the ARP repply shall have the eth0 MAC as destination? For a transparent bridge the MACs shall not be changed, isnt't it?
    – Xcoder
    Nov 17, 2015 at 22:10
  • Yes, I typed that in a hurry, the destination MAC should be that of the sending party, so that is correct - and you have confirmed that the destination MAC is in showmacs. It doesn't arrive at br0 - are you tcpdumping the bridge or the physical?
    – Paul
    Nov 17, 2015 at 22:24

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .