You havn't said anything about IP configuration, and IP configuration is precisely what you need to address problem #3.
Choose your IP plan carefully
Your whole network will have a "general IP scheme". For instance, a lot of networks use
You can use any IP private space, both in IPv4 and IPv6. Make sure it would not collide with any other networks your users or RPis might be connected to.
For instance, let's say we will use the global network
172.17.*.*. Note that the "all-zero" (
172.17.*.0) and "all-ones" (
172.17.*.255) addresses are reserved (i.e. not usable) in a network and all its subdivisions.
We will have to subdivide this big network into smaller networks that every RPi will use independently. One of the subnetworks will be used for communication between the RPis, for that we will keep
172.17.0.* for ourselves. We could use another number, but using 0 makes it easy to configure the Pis with a script.
The "public" part of the network will use the IPs
xxx is unique to each RPi. Again, to make it easy for a script, we start at 1, and increment.
The RPis need an IP in both networks. For the public network, it's best practice to use
.254, so it will be
172.17.xxx.254. But what about the central network? The RPi will be used as a gateway to network
172.17.xxx.* by the opther RPis. It would only be logical to match IP address to relayed network: we'll use
Set up the Pis
Configure your RPis'
wlan1 (the public interface) to use the fixed IP
xxx is unique among all your RPis and not 0 (see above). Netmask is
Configure your RPis'
wlan0 (the private interface) to use the fixed IP
xxx is the same as above. Netmask is
On every RPi, run the following script, after replacing
$END by the number of RPis you're using:
echo 1 > /proc/sys/net/ipv4/ip_forward
for i in $(seq 1 $END); do route add -net 172.17.$i.0 netmask 255.255.255.0 gw 172.17.0.$i; done
iptables -A FORWARD -s 172.17.0.0/16 -d 172.17.0.0/16 -j ACCEPT
TL;DR, we do the following: we choose a big network, here
172.17.0.0/16. We subdivide it in 255 smaller networks:
172.17.xxx.0/24. We keep
0 for ourselves, and give all other numbers to the users. Then, we tell the RPis to transfer packets headed to other computers to the appropriate "gateway" RPi.
Tell the users' devices to look in the right place
I assume you are using dnsmasq as the DHCP server for the public networks. In order to have the user devices configured correctly, you will need to tweak its settings.
Set up DHCP so it serves addresses in a range adapted to the network, I.E.
Add a static route the the DHCP part of dnsmasq config (again replacing
Using a static route avoid overwriting the default gateway of your clients. This way, if they are still connected to another network (i.e. a laptop with Ethernet plugged in), they should not have any problem.
Make sure you test this with 1 or 2 Pis and 1 or 2 clients before doing committing to set up all your RPis.