f1linux/pi-ap

Raspberry Pi wireless Access Point: This repo automates the config of hostapd, dnsmasq, dhcpcd & wpa_supplicant to transform a Pi into an AP. Requires: a Pi, Ethernet cable & DHCP-enabled port on a broadband router or a switch connected to this router. For other interesting & practical Pi solutions, my Stack page is: https://raspberrypi.stackexchange.com/users/97613/f1linux

#

# pi-ap: These scripts configure a Raspberry Pi into a wireless Access Point

# Source: https://github.com/f1linux/pi-ap

Version: 01.10.02

# License: GPL 3.0

# Script Author: Terrence Houlahan Linux & Network Engineer

# Contact: [email protected]

# Linkedin: www.linkedin.com/in/terrencehoulahan

README CONTENTS:

1. ABOUT "pi-ap"
2. USE-CASES
3. COMPATIBILITY
4. FEATURES
5. LICENSE
6. HARDWARE REQUIREMENTS
7. INSTALLATION
8. CONNECTING TO AP
9. TROUBLESHOOTING
10. USEFUL LINKS: Wiki & YouTube Channel

1. ABOUT "pi-ap":

"pi-ap" is a series of bash scripts that automates configuration of below standardized packages to transform a PI into a wireless Access Point ("AP"):

• hostapd: Probably the most widely used package for creating an AP in Linux and a standard

• wpa_supplicant: Client Authentication

• dhcpcd: Interface management

• dnsmasq: DHCP for connecting AP clients: Assigns IPs and the DNS servers clients should use

Other host configuration is performed, but the foregoing are the key packages related to delivering the AP functionality

2. USE-CASES

pi-ap is NOT meant to replace enterprise class AP systems which offer beefier hardware and joined-up management interfaces for building or campus deployments. The obvious use cases for these scripts is:

• Dead-Spot Coverage: Individuals and small businesses with a few dead-spots in their WiFi coverage can use this solution

• Event Coverage: Connect a pi-ap to a long Ethernet cable out of a window into your back yard for hammock surfing :-)

• Network Training: An AP is a networking microcosm offering wide opportunities for teaching networking configuration & troubleshooting on inexpensive commodity hardware

3. COMPATIBILITY

These scripts have been tested on the following Pi models & OSs and found to work correctly:

• Pi 3B+: Raspbian Stretch (2019-04-08) and Buster (2019-07-10)

• Pi 4: Raspbian Buster (2019-07-10)

4. FEATURES

• No Subnetting Required: DHCP IP pool for connecting clients is automatically calculated from a single IP and mask you specify

• Auto Config of WiFi Regulatory Zone: This is derived from the Public IP you are NATing out from and ensures you cannot make an error setting it

• MAC Address Restriction: In addition to restricting by password you also have the ability to restrict by hardware address of connecting devices

• Centralized Package Management: Customize the package list by editing the list in "packages-list-install.txt"

• Modular Design: Configuration is broken down into scripts organized by taxonomy: ie FW, packages, Kernel, AP stuff, etc...

• Crypto uses Hardware Random Number Generator ("RNG"): Entropy generated via hardware RNG using rng-tools

5. LICENSE

Terrence Houlahan developed "pi-ap" and opensources it under the terms of the GPL 3.0 License that is distributed with my repo source files

6. HARDWARE REQUIREMENTS

Pi Case:

AVOID METAL CASES!!! If you wrap a metal case around your Pi it is going to cause Layer 1 problems by impeding the signal.

Probably worth trying a few different cases of differing materials to see which gives you the best result in respect to signal performance.

NON-POE:

A long Ethernet cable, a Pi and a power supply are minimum requirements.

HOWEVER: Using an AP implies covering an area the antenna(s) of the router cannot itself reach. At such a distance- probably greater than 40 feet- or any distance their is not a mains outlet to power the Pi, using a single Ethernet cable for both Data + Power becomes more interesting.

POE:

POE gear I have had success with- YMMV- with my Pi applications is:

• Ethernet Cable: A Tripp Lite Cat6 24 AWG Ethernet Cable is suggested (for most use cases). Amazon sells them in various lengths & colours

• POE Switch: ZyXEL 8-Port GS1900-8HP-GB0102F switch. Also found on Amazon. Lots of features for a reasonable price

• POE Hat or POE Splitter: Although most Pi vendors sell the POE Hat, POE Splitters will be found on Amazon.

I discuss POE gear and perform a cost vs. benefit analysis at below link for those considering a POE implementation for their pi-ap:

choosing-a-pi4-power-supply

7. INSTALLATION & CONFIGURATION:

Hardware Configuration:

• Connect the Pi's eth0 port to a DHCP-enabled port in a router configured with Internet connection or a switch connected to this router.

NOTE: You can connect a "*pi-ap" to some intermediate router but you will of course have to configure the routing so the Pi can reach the router with the Internet connection.

Software Configuration:

All the complex configuration is abstracted into a centralized variables file named "variables.sh". This file is sourced by all repo scripts. Edit this file in nano to modify default values and execute install.sh. All the other scripts are chained off of install.sh That it to achieve a working Pi AP

Either using a local or SSH connection to the Pi execute the following commands:

• a) git clone https://github.com/f1linux/pi-ap

• b) Change Default Pi Password! Open a terminal and execute sudo su - and passwd pi

• c) cd pi-ap

• d) nano variables.sh # Modify default variable values. Most default values can be kept but change "APWPA2PASSWD" and if default WiFi subnet in "IPV4IPWLAN0='192.168.0.1/28' exists on your LAN set to a different subnet"

• e) nano hostapd.accept # If variable "MACADDRACL" set to "1" then add MAC addresses of clients allowed to connect to pi-ap before executing script

• f) sudo ./install.sh # Execute the install script which will call all the other scripts in the repo.

• g) cd ..;rm -rf pi-ap # Optionally delete the repo after "install.sh" completes.

8. CONNECTING TO AP:

After setup completes, to connect to your new Pi Access Point:

• a) Find its SSID inWireless Networks and connect with the password you set in variable "APWPA2PASSWD" when modifying variables.sh

• ssh [email protected] # This is the default IP variable "IPV4IPWLAN0"

You're in.

9. TROUBLESHOOTING

A suggested non-exhausitive list of things to investigate if pi-ap broken:

• sudo ufw status: Check FW not disabled. Needs to be up or masquerading in NAT table breaks

• Non-Metallic: If using a case for your Pi, only use a NON-METALLIC one to avoid Layer 1 connectivity problems

• Physical Positioning: Is there anything that will impede or interfere with the radio?

• FW In Front of Pi Not Blocking: Look for restrictive rules on any FW's in front of the pi-ap

• ip addr list: Check interfaces are all up. wlan0 must be up to connect to AP. eth0 must be up for AP traffic to reach Internet

• sudo systemctl status hostapd.service: When hostapd is not happy, your AP will be down.

• sudo systemctl status wpa_supplicant.service: When wpa_supplicant is not happy, clients cannot connect to AP.

• cat /proc/sys/kernel/random/entropy_avail: Use this command to investigate insufficient entropy errors when checking wpa_supplicant status

• tail -fn 100 /var/log/syslog: Review syslog for any interesting errors to investigate

• No Clashing Subnets: Variable "IPV4IPWLAN0" in variables.sh is used to setup the AP interface & create IP pool to assign addresses to connecting clients. Ensure "IPV4IPWLAN0" does not clash with any existing subnets

10. USEFUL LINKS:

Pi-AP YouTube Channel: F1Linux

Pi-AP Wiki: Github

I think that about covers it. Not a lot really to do to configure a Pi into a working Access Point with this pile of scripts...

Terrence Houlahan, Linux & Network Engineer F1Linux.com

Linkedin: Terrence Houlahan

pi-ap's Issues

pi-ap Bug Report : Script No Longer Enables AP mode

Script No Longer Enables AP mode because of rfkill

Firstly, thank you for making this script available. It is clear you have spent a lot of time and applied a high level of expertise to produce this script. Being able to run a script in a few minutes is a much better solution than transcribing a series of instructions. Well done.

OK so During installation, I get the following error message:

Job for hostapd.service failed because the control process exited with error code.

As a result, the wifi does not run in AP mode.

Also, just a small point, Raspbian Lite does not have git installed by default.

I did the installation with a new virgin install of Raspbian Buster Lite. No other applications were installed. I burned a fresh install of Buster and then installed pi-ap without making any changes to the OS or the pi-ap scripts or variables.

After installation, AP mode was not enabled.

Did AP EVER work correctly before fault?

Never tried it before.

Bug CONSISTENTLY reproducible?

yes

If "yes", provide detailed steps to reproduce bug:
Just run the unmodified pi-ap scripts/variables on a fresh install of Buster.

Error Messages/Screenshots

Additional context

The reason I found your script was because my own, much simpler script, shows the same problem. I get the same error message at the same stage in installation.

Proposed Fixes
IF you have any suggested fixes, please describe them here.

Yes. Add the following commands to the script.

echo "Unblock and enable wifi "
rfkill unblock wlan
echo " Check that wifi is unblocked. "
rfkill list wlan

AP Client:
Please provide details about the client used to connect to the AP:

The RPi clients can't connect to the RPi server AP.

Backup

Does this tool keeps a backup of the original files?
I cant see it mentioned.

Question about customization Hostname etc.

Can be deleted. Found MY error. Sry.
Tryed to put the AP in the range of the eth-net.

To fast reboot at the end of the install.sh script ?

I had a lot of problems with the script. Sometime I could not get internet access on the AP.

I think the problem was that the raspberry pie rebooted to fast at the end of the installation script. Looks like all the configuration did not have time to write the data from memory to the SD card before it rebooted. Maybe the last commands in the script was not saved ?

I put an sleep 10, command at the end of the installation script before the reboot so all the files was written to the card. At this time I had no problem. Maybe I had an slow SD card or something. It was on an Raspberry Pi 3B+

echo "WIRELESS:"
echo "##########"
echo "Output of: $(tput setaf 9)iw dev wlan0 info$(tput sgr 0)"
iw dev wlan0 info
echo
echo "Output of: $(tput setaf 9)iwconfig wlan0$(tput sgr 0)"
iwconfig wlan0
echo

echo "Config Completed. Host will reboot now"
sleep 10
echo
systemctl reboot

Proposition for improvement

Hello and thanks for this amazing collection of scripts. I used different methods of creating an AP so far with the pi, and they all work to an extent, but your script is by far not only the fastest to set up but also gives (for me at least) the most reliable, faster AP I could come up with.

Now my issue is: devices on my local network can ping each other only if they 're connected to the AP, or to the router. Devices connected to the AP can ping devices plugged into the router, but not the other way round. I guess it's because your script creates a subnet that (explicitly so) needs to NOT be in the same subnet as the router for example. And indeed, giving the same subnet in variables.sh before running the script results in the AP being broken. My question is: is there a way to configure pi-ap so that it puts the pi in repeater mode somehow, where it just propagates the local network and everyone can happily ping each other ? On a more general note, can you tweak the behavior of the AP without running the install script all over again ? I guess I could try some iptables routing, or changing the dnsmasq configuration and so on, but so much gets done during the install script (including ufw rules that I don't fully understand) that i'd be afraid of breaking something. Thank you so much for your time.

Add a VPN client

Hi, great script, thank you. Just a suggestion for an improvement. Would it be possible to add VPN connection configuration on the ethernet port ?

Http seems disabled after installation

After installation, I can no longer connect to my server via http.
I've tried disabling the firewall rules but it makes no difference.

ufw deactivated after install

Describe bug
After running install.sh ufw is deactivated, and previously added custom rules have been cleared.

Did AP EVER work correctly before fault?

• no

Bug CONSISTENTLY reproducible?

• yes

If "yes", provide detailed steps to reproduce bug:

sudo ufw enable
sudo ./install.sh

Additional context

The very first TROUBLESHOOTING item is to check ufw, so it wasn't hard to fix, but it seems odd that enabling ufw should not be part of the install script.

And yes, ufw was active before running the script, and I had added some custom rules that got deleted. It seems like it reset ufw to an initial inactive state.

Otherwise the process was seamless.

Proposed Fixes

The install script should enable ufw, and preserve existing rules.

Uninstall

Hi,

there is a script to uninstall all of this to come back to the previous state before the installation ?

Thanks