我正在尝试设置一个无线接入点,由 Hostapd 管理并支持动态 VLAN。 VLAN 由我用于 802.X 身份验证的 FreeRadius 服务器动态管理。
我使用两台设备来测试我的配置:一台笔记本电脑(地址 192.168.0.2)和一部电话(地址 192.168.0.3)。两者使用同一个VLAN,可以互相通信。但我无法从任一接入点(地址 192.168.0.1)执行 ping 操作。
我对 Hostapd 有以下配置:
###### GENERAL CONFIG ######
# define interface and driver
interface=wlp2s0
driver=nl80211
ssid=MUDDY
channel=1
# WPA2 enterprise auth
wpa=2
wpa_key_mgmt=WPA-EAP
wpa_pairwise=TKIP CCMP
# log level, all modules and somewhat verbose
logger_syslog=-1
logger_syslog_level=0
logger_stdout=-1
logger_stdout_level=1
# could be useful in the future
ctrl_interface=/var/run/hostapd
ctrl_interface_group=0
# we want 802.1x auth
ieee8021x=1
# whatever
eapol_key_index_workaround=0
# nope, no integrated eap
eap_server=0
###### RADIUS CONFIG ######
# probably irrelevant with nas_identifier set
own_ip_addr=127.0.0.1
# might make own_ip_addr irrelevant
#nas_identifier=my.nas
# address and port of RADIUS auth server
auth_server_addr=127.0.0.1
auth_server_port=1812
auth_server_shared_secret=somuchsecret
# we want accounting and be able to receive CoA messages
acct_server_addr=127.0.0.1
acct_server_port=1813
acct_server_shared_secret=somuchsecret
radius_das_port=3799
radius_das_client=127.0.0.1 thatsabigsecretohyeah
# accounting every minute
radius_acct_interim_interval=60
# VLANs are dealt with by the Radius server
dynamic_vlan=1
Hostapd创建的接口如下:
$ ip link
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: enp0s31f6: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP mode DEFAULT group default qlen 1000
link/ether 98:4f:ee:14:16:23 brd ff:ff:ff:ff:ff:ff
3: wlp2s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP mode DEFAULT group default qlen 1000
link/ether 34:f3:9a:b3:8d:69 brd ff:ff:ff:ff:ff:ff
8: wlp2s0.149: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq master brvlan149 state UNKNOWN mode DEFAULT group default qlen 1000
link/ether 34:f3:9a:b3:8d:69 brd ff:ff:ff:ff:ff:ff
9: brvlan149: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP mode DEFAULT group default qlen 1000
link/ether 34:f3:9a:b3:8d:69 brd ff:ff:ff:ff:ff:ff
当我的笔记本电脑发送 ARP 请求时,回复将通过 brvlan149 网桥和 wlp2s0.149 端口发送。
但是,检索我的笔记本电脑 IP 的 ARP 请求(发送 ping 回复所必需的)是从 wlp2s0 接口发送的,而笔记本电脑从未收到它。
我不明白这种行为,以及 Hostapd(或 Linux)如何管理接口。我使用的是 Hostapd 2.6 版本。
我已停用反向路径过滤,因为这似乎会在类似配置中引起问题。
我的路线如下:
$ ip route show table all
default via 192.168.234.1 dev enp0s31f6 proto static metric 100
130.225.68.3 via 192.168.234.1 dev enp0s31f6 proto dhcp metric 100
169.254.0.0/16 dev enp0s31f6 proto static scope link metric 1000
192.168.0.0/24 dev wlp2s0 proto kernel scope link src 192.168.0.1
192.168.234.0/24 dev enp0s31f6 proto kernel scope link src 192.168.234.177 metric 100
broadcast 127.0.0.0 dev lo table local proto kernel scope link src 127.0.0.1
local 127.0.0.0/8 dev lo table local proto kernel scope host src 127.0.0.1
local 127.0.0.1 dev lo table local proto kernel scope host src 127.0.0.1
broadcast 127.255.255.255 dev lo table local proto kernel scope link src 127.0.0.1
broadcast 192.168.0.0 dev wlp2s0 table local proto kernel scope link src 192.168.0.1
local 192.168.0.1 dev wlp2s0 table local proto kernel scope host src 192.168.0.1
broadcast 192.168.0.255 dev wlp2s0 table local proto kernel scope link src 192.168.0.1
broadcast 192.168.234.0 dev enp0s31f6 table local proto kernel scope link src 192.168.234.177
local 192.168.234.177 dev enp0s31f6 table local proto kernel scope host src 192.168.234.177
broadcast 192.168.234.255 dev enp0s31f6 table local proto kernel scope link src 192.168.234.177
fe80::/64 dev enp0s31f6 proto kernel metric 256 pref medium
fe80::/64 dev wlp2s0 proto kernel metric 256 pref medium
fe80::/64 dev wlp2s0.149 proto kernel metric 256 pref medium
fe80::/64 dev brvlan149 proto kernel metric 256 pref medium
local ::1 dev lo table local proto kernel metric 0 pref medium
local fe80::36f3:9aff:feb3:8d69 dev wlp2s0 table local proto kernel metric 0 pref medium
local fe80::36f3:9aff:feb3:8d69 dev wlp2s0.149 table local proto kernel metric 0 pref medium
local fe80::6c8a:e7ff:fe1a:55cc dev brvlan149 table local proto kernel metric 0 pref medium
local fe80::d124:3999:7e3:55fe dev enp0s31f6 table local proto kernel metric 0 pref medium
ff00::/8 dev enp0s31f6 table local metric 256 pref medium
ff00::/8 dev wlp2s0 table local metric 256 pref medium
ff00::/8 dev wlp2s0.149 table local metric 256 pref medium
ff00::/8 dev brvlan149 table local metric 256 pref medium
有关桥梁的详细信息如下:
$ ip -details link show brvlan149
5: brvlan149: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP mode DEFAULT group default qlen 1000
link/ether 34:f3:9a:b3:8d:69 brd ff:ff:ff:ff:ff:ff promiscuity 0
bridge forward_delay 0 hello_time 200 max_age 2000 ageing_time 30000 stp_state 0 priority 32768 vlan_filtering 0 vlan_protocol 802.1Q addrgenmode eui64
如何使接入点的 ARP 请求从正确的接口发送?