时间戳

首页 > 技术文章 > Openwrt开发之wifi sta设置

Openwrt开发之wifi sta设置

weishengzhong 2019-08-19 20:11 原文

场景：

openwrtWIFI当做sta，连接上级AP，其他外设比如手机、pc设备连接到openwrt的局域网，通过openwrt访问外网。

 

配置wpa_cli wpa_supplicant

 

  <*> wpa-cli...................... WPA Supplicant command line control utility                      
  <*> wpa-supplicant............................................ WPA Supplicant

 

 

dhcp配置：

config dnsmasq
        option domainneeded     1
        option boguspriv        1
        option filterwin2k      0  # enable for dial on demand
        option localise_queries 1
        option rebind_protection 1  # disable if upstream must serve RFC1918 addresses
        option rebind_localhost 1  # enable for RBL checking and similar services
        #list rebind_domain example.lan  # whitelist RFC1918 responses for domains
        option local    '/lan/'
        option domain   'lan'
        option expandhosts      1
        option nonegcache       0
        option authoritative    1
        option readethers       1
        option leasefile        '/tmp/dhcp.leases'
        option resolvfile       '/tmp/resolv.conf.auto'
        #list server            '/mycompany.local/1.2.3.4'
        option nonwildcard      1 # bind to & keep track of interfaces
        #list interface         br-lan
        #list notinterface      lo
        #list bogusnxdomain     '64.94.110.11'
        option localservice     1  # disable to allow DNS requests from non-local subnets

config dhcp lan
        option interface        lan
        option start    100
        option limit    150
        option leasetime        12h

config dhcp wan
        option interface        wan
        option ignore   1

network配置：

config interface 'loopback'
        option ifname 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd41:6975:8c8b::/48'

config interface 'wan'
        option ifname 'eth0.1'
        option proto 'dhcp'

config interface 'Wwan'
        option proto 'dhcp'

config device 'wan_dev'
        option name 'eth0.1'
        option macaddr '00:0c:24:09:76:28'

config interface 'wan6'
        option ifname 'eth0.1'
        option proto 'dhcpv6'

config interface 'lan'
        option type 'bridge'
        option ifname 'eth0.2'
        option proto 'static'
        option ipaddr '10.10.10.254'
        option netmask '255.255.255.0'
        option ip6assign '60'

config device 'lan_dev'
        option name 'eth0.2'
        option macaddr '00:0c:24:09:76:27'

config switch
        option name 'switch0'
        option reset '1'
        option enable_vlan '1'

config switch_vlan
        option device 'switch0'
        option vlan '1'
        option ports '0 6t'

config switch_vlan
        option device 'switch0'
        option vlan '2'
        option ports '1 2 3 4 6t'

wireless配置

config wifi-device 'radio0'
        option type 'mac80211'
        option channel '11'
        option hwmode '11g'
        option path 'platform/10300000.wmac'
        option htmode 'HT20'
        option disabled '0'

config wifi-iface 'default_radio0'
        option device 'radio0'
        option network 'Wwan'
        option mode 'sta'
        option encryption 'psk2'
        option ssid 'ssid—name'
        option key 'password'

firewall配置

config defaults
        option syn_flood        1
        option input            ACCEPT
        option output           ACCEPT
        option forward          REJECT
# Uncomment this line to disable ipv6 rules
#       option disable_ipv6     1

config zone
        option name             lan
        list   network          'lan'
        option input            ACCEPT
        option output           ACCEPT
        option forward          ACCEPT

config zone
        option name             wan
        list   network          'wan'
        list   network          'wan6'
        list   network          'Wwan'
        option input            REJECT
        option output           ACCEPT
        option forward          REJECT
        option masq             1
        option mtu_fix          1

config forwarding
        option src              lan
        option dest             wan

# We need to accept udp packets on port 68,
# see https://dev.openwrt.org/ticket/4108
config rule
        option name             Allow-DHCP-Renew
        option src              wan
        option proto            udp
        option dest_port        68
        option target           ACCEPT
        option family           ipv4

# Allow IPv4 ping
config rule
        option name             Allow-Ping
        option src              wan
        option proto            icmp
        option icmp_type        echo-request
        option family           ipv4
        option target           ACCEPT

config rule
        option name             Allow-IGMP
        option src              wan
        option proto            igmp
        option family           ipv4
        option target           ACCEPT

# Allow DHCPv6 replies
# see https://dev.openwrt.org/ticket/10381
config rule
        option name             Allow-DHCPv6
        option src              wan
        option proto            udp
        option src_ip           fc00::/6
        option dest_ip          fc00::/6
        option dest_port        546
        option family           ipv6
        option target           ACCEPT

config rule
        option name             Allow-MLD
        option src              wan
        option proto            icmp
        option src_ip           fe80::/10
        list icmp_type          '130/0'
        list icmp_type          '131/0'
        list icmp_type          '132/0'
        list icmp_type          '143/0'
        option family           ipv6
        option target           ACCEPT

# Allow essential incoming IPv6 ICMP traffic
config rule
        option name             Allow-ICMPv6-Input
        option src              wan
        option proto    icmp
        list icmp_type          echo-request
        list icmp_type          echo-reply
        list icmp_type          destination-unreachable
        list icmp_type          packet-too-big
        list icmp_type          time-exceeded
        list icmp_type          bad-header
        list icmp_type          unknown-header-type
        list icmp_type          router-solicitation
        list icmp_type          neighbour-solicitation
        list icmp_type          router-advertisement
        list icmp_type          neighbour-advertisement
        option limit            1000/sec
        option family           ipv6
        option target           ACCEPT

# Allow essential forwarded IPv6 ICMP traffic
config rule
        option name             Allow-ICMPv6-Forward
        option src              wan
        option dest             *
        option proto            icmp
        list icmp_type          echo-request
        list icmp_type          echo-reply
        list icmp_type          destination-unreachable
        list icmp_type          packet-too-big
        list icmp_type          time-exceeded
        list icmp_type          bad-header
        list icmp_type          unknown-header-type
        option limit            1000/sec
        option family           ipv6
        option target           ACCEPT

config rule
        option name             Allow-IPSec-ESP
        option src              wan
        option dest             lan
        option proto            esp
        option target           ACCEPT

config rule
        option name             Allow-ISAKMP
        option src              wan
        option dest             lan
        option dest_port        500
        option proto            udp
        option target           ACCEPT

# include a file with users custom iptables rules
config include
        option path /etc/firewall.user


### EXAMPLE CONFIG SECTIONS
# do not allow a specific ip to access wan
#config rule
#       option src              lan
#       option src_ip   192.168.45.2
#       option dest             wan
#       option proto    tcp
#       option target   REJECT

# block a specific mac on wan
#config rule
#       option dest             wan
#       option src_mac  00:11:22:33:44:66
#       option target   REJECT

# block incoming ICMP traffic on a zone
#config rule
#       option src              lan
#       option proto    ICMP
#       option target   DROP

# port redirect port coming in on wan to lan
#config redirect
#       option src                      wan
#       option src_dport        80
#       option dest                     lan
#       option dest_ip          192.168.16.235
#       option dest_port        80
#       option proto            tcp

# port redirect of remapped ssh port (22001) on wan
#config redirect
#       option src              wan
#       option src_dport        22001
#       option dest             lan
#       option dest_port        22
#       option proto            tcp

### FULL CONFIG SECTIONS
#config rule
#       option src              lan
#       option src_ip   192.168.45.2
#       option src_mac  00:11:22:33:44:55
#       option src_port 80
#       option dest             wan
#       option dest_ip  194.25.2.129
#       option dest_port        120
#       option proto    tcp
#       option target   REJECT

#config redirect
#       option src              lan
#       option src_ip   192.168.45.2
#       option src_mac  00:11:22:33:44:55
#       option src_port         1024
#       option src_dport        80
#       option dest_ip  194.25.2.129
#       option dest_port        120
#       option proto    tcp

config rule
    option name 'Allow-SSH'
    option target ACCEPT
    option src 'wan'
    option dest_port '22'
    option proto 'tcp'
    option family 'ipv4'

config rule
        option name 'Allow-http'
        option src              wan
        option dest_port        80
        option target           ACCEPT
        option proto            tcp

 

配置基本完成，作为sta连接到ap，需要不同的加密方式，比如none、wep、wpa、wpa2等，如果仅仅是none、wep格式直接用iw connect即可完成连接，其他的加密方式，则需要用到 wpa_supplicant，使用方法如下：

wpa_supplicant -Dnl80211 -iwlan0 -c/var/run/wpa_supplicant-wlan0.conf -B

-B是后台进行wifi的连接，

-c/etc/wpa_supplicant-wlan0.conf 是要连接的ap的配置信息，比如ssid名，key等；因此再运行这条命令之前需要在/etc目录下建立wpa_supplicant.conf 文件输入以下内容：
network{
    ssid=“ssid—name”
    psk=“password”
}

或者用以下命令自动生成这个配置文件

wpa_passphrase "<wifi_ssid>" "<password>" >> /etc/wpa_supplicant.conf

 

openwrt uci会自动调用 wpa_cli 创建该配置文件到/var/run/文件夹，也就是 wpa_supplicant-wlan0.conf 文件，所以openwrt下不需要再另外创建该文件，而且在配置/etc/config/wireless 文件后，会自动更新 wpa_supplicant-wlan0.conf 文件

 

最后可以使用如下命令来查看wifi连接状态

iw dev wlan0 link

注：wlan0是本人开发板上的wifi设备。

至此，所有连接到openwrt局域网内的设备，均可以通过openwrt访问上级ap，若是上级ap可以访问外网，则openwrt局域网内的所有设备均可以访问外网，相当于openwrt是个无线网卡；

 

以上配置在测试的时候发现有个小问题：

当有线接到openwrt开发板的wan口，并且openwrt的wifi连接到ap的时候，如果使用 wpa_cli disconnect 命令断开wifi连接，这个时候有线不能上外网；但是如果wan口没有有线连接的时候，先连接wifi，然后再断开wifi，再连接有线，有线却可以连接外网；比较奇葩的问题……

 

简单的说就是不支持有线和wifi同时连接外网……

具体现象如下：

ping www.baidu.com 或者ping 百度的ip均返回：ping: sendto: Network is unreachable

问题根源：

route命令查看IP路由表信息如下：

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
10.10.10.0      *               255.255.255.0   U     0      0        0 br-lan
192.168.2.0     *               255.255.255.0   U     0      0        0 eth0.1

网关地址都是 * ，貌似没有网关地址……

于是手动添加网关

route add default gw 192.168.2.1

再用route查看ip表显示如下：

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         192.168.2.1     0.0.0.0         UG    0      0        0 eth0.1
10.10.10.0      *               255.255.255.0   U     0      0        0 br-lan
192.168.2.0     *               255.255.255.0   U     0      0        0 eth0.1

此时再ping 外网，可以正常工作；

 为了解决这个小问题，可以增加个小脚本 script 来手动切换有线和wifi：

由于openwrt默认的是优先wifi连外网（本人测试环境如此……）所以只需监测wifi的连接和断开就行：

 

#!/bin/bash

case "$2" in
    CONNECTED)
#        notify-send "WPA supplicant: connection established";
       echo "WPA supplicant: connection established";
        ;;
    DISCONNECTED)
#        notify-send "WPA supplicant: connection lost";
       echo "WPA supplicant: connection lost";
        ;;
esac

再添加运行权限： chmod +x  ./script 

使用  wpa_cli -a /yourpath/script 命令监测wifi连接状态；

脚本里面信息可以替换为修改网关的指令……

当使用wpa_cli 命令连接或者断开wifi的时候系统会弹出提示信息，如果是AP测主动断开，还未测试，不知道会是啥结果……

 

推荐阅读