Openwrt開發之wifi sta設置

場景：

openwrtWIFI當做sta，連接上級AP，其他外設比如手機、pc設備連接到openwrt的局域網，通過openwrt訪問外網。

 

配置wpa_cli wpa_supplicant

 

  <*> wpa-cli...................... WPA Supplicant command line control utility                      
  <*> wpa-supplicant............................................ WPA Supplicant      

 

 

dhcp配置：

config dnsmasq
        option domainneeded     1
        option boguspriv        1
        option filterwin2k      0  # enable for dial on demand
        option localise_queries 1
        option rebind_protection 1  # disable if upstream must serve RFC1918 addresses
        option rebind_localhost 1  # enable for RBL checking and similar services
        #list rebind_domain example.lan  # whitelist RFC1918 responses for domains
        option local    '/lan/'
        option domain   'lan'
        option expandhosts      1
        option nonegcache       0
        option authoritative    1
        option readethers       1
        option leasefile        '/tmp/dhcp.leases'
        option resolvfile       '/tmp/resolv.conf.auto'
        #list server            '/mycompany.local/1.2.3.4'
        option nonwildcard      1 # bind to & keep track of interfaces
        #list interface         br-lan
        #list notinterface      lo
        #list bogusnxdomain     '64.94.110.11'
        option localservice     1  # disable to allow DNS requests from non-local subnets

config dhcp lan
        option interface        lan
        option start    100
        option limit    150
        option leasetime        12h

config dhcp wan
        option interface        wan
        option ignore   1

network配置：

config interface 'loopback'
        option ifname 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd41:6975:8c8b::/48'

config interface 'wan'
        option ifname 'eth0.1'
        option proto 'dhcp' config interface 'Wwan' option proto 'dhcp'

config device 'wan_dev'
        option name 'eth0.1'
        option macaddr '00:0c:24:09:76:28'

config interface 'wan6'
        option ifname 'eth0.1'
        option proto 'dhcpv6'

config interface 'lan'
        option type 'bridge'
        option ifname 'eth0.2'
        option proto 'static'
        option ipaddr '10.10.10.254'
        option netmask '255.255.255.0'
        option ip6assign '60'

config device 'lan_dev'
        option name 'eth0.2'
        option macaddr '00:0c:24:09:76:27'

config switch
        option name 'switch0'
        option reset '1'
        option enable_vlan '1'

config switch_vlan
        option device 'switch0'
        option vlan '1'
        option ports '0 6t'

config switch_vlan
        option device 'switch0'
        option vlan '2'
        option ports '1 2 3 4 6t'

wireless配置

config wifi-device 'radio0'
        option type 'mac80211'
        option channel '11'
        option hwmode '11g'
        option path 'platform/10300000.wmac'
        option htmode 'HT20'
        option disabled '0'

config wifi-iface 'default_radio0'
        option device 'radio0'
        option network 'Wwan'
        option mode 'sta'
        option encryption 'psk2'
        option ssid 'ssid—name'
        option key 'password'

firewall配置

config defaults
        option syn_flood        1
        option input            ACCEPT
        option output           ACCEPT
        option forward          REJECT
# Uncomment this line to disable ipv6 rules
#       option disable_ipv6     1

config zone
        option name             lan
        list   network          'lan'
        option input            ACCEPT
        option output           ACCEPT
        option forward          ACCEPT

config zone
        option name             wan
        list   network          'wan'
        list   network          'wan6' list network 'Wwan'
        option input            REJECT
        option output           ACCEPT
        option forward          REJECT
        option masq             1
        option mtu_fix          1

config forwarding
        option src              lan
        option dest             wan

# We need to accept udp packets on port 68,
# see https://dev.openwrt.org/ticket/4108
config rule
        option name             Allow-DHCP-Renew
        option src              wan
        option proto            udp
        option dest_port        68
        option target           ACCEPT
        option family           ipv4

# Allow IPv4 ping
config rule
        option name             Allow-Ping
        option src              wan
        option proto            icmp
        option icmp_type        echo-request
        option family           ipv4
        option target           ACCEPT

config rule
        option name             Allow-IGMP
        option src              wan
        option proto            igmp
        option family           ipv4
        option target           ACCEPT

# Allow DHCPv6 replies
# see https://dev.openwrt.org/ticket/10381
config rule
        option name             Allow-DHCPv6
        option src              wan
        option proto            udp
        option src_ip           fc00::/6
        option dest_ip          fc00::/6
        option dest_port        546
        option family           ipv6
        option target           ACCEPT

config rule
        option name             Allow-MLD
        option src              wan
        option proto            icmp
        option src_ip           fe80::/10
        list icmp_type          '130/0'
        list icmp_type          '131/0'
        list icmp_type          '132/0'
        list icmp_type          '143/0'
        option family           ipv6
        option target           ACCEPT

# Allow essential incoming IPv6 ICMP traffic
config rule
        option name             Allow-ICMPv6-Input
        option src              wan
        option proto    icmp
        list icmp_type          echo-request
        list icmp_type          echo-reply
        list icmp_type          destination-unreachable
        list icmp_type          packet-too-big
        list icmp_type          time-exceeded
        list icmp_type          bad-header
        list icmp_type          unknown-header-type
        list icmp_type          router-solicitation
        list icmp_type          neighbour-solicitation
        list icmp_type          router-advertisement
        list icmp_type          neighbour-advertisement
        option limit            1000/sec
        option family           ipv6
        option target           ACCEPT

# Allow essential forwarded IPv6 ICMP traffic
config rule
        option name             Allow-ICMPv6-Forward
        option src              wan
        option dest             *
        option proto            icmp
        list icmp_type          echo-request
        list icmp_type          echo-reply
        list icmp_type          destination-unreachable
        list icmp_type          packet-too-big
        list icmp_type          time-exceeded
        list icmp_type          bad-header
        list icmp_type          unknown-header-type
        option limit            1000/sec
        option family           ipv6
        option target           ACCEPT

config rule
        option name             Allow-IPSec-ESP
        option src              wan
        option dest             lan
        option proto            esp
        option target           ACCEPT

config rule
        option name             Allow-ISAKMP
        option src              wan
        option dest             lan
        option dest_port        500
        option proto            udp
        option target           ACCEPT

# include a file with users custom iptables rules
config include
        option path /etc/firewall.user


### EXAMPLE CONFIG SECTIONS
# do not allow a specific ip to access wan
#config rule
#       option src              lan
#       option src_ip   192.168.45.2
#       option dest             wan
#       option proto    tcp
#       option target   REJECT

# block a specific mac on wan
#config rule
#       option dest             wan
#       option src_mac  00:11:22:33:44:66
#       option target   REJECT

# block incoming ICMP traffic on a zone
#config rule
#       option src              lan
#       option proto    ICMP
#       option target   DROP

# port redirect port coming in on wan to lan
#config redirect
#       option src                      wan
#       option src_dport        80
#       option dest                     lan
#       option dest_ip          192.168.16.235
#       option dest_port        80
#       option proto            tcp

# port redirect of remapped ssh port (22001) on wan
#config redirect
#       option src              wan
#       option src_dport        22001
#       option dest             lan
#       option dest_port        22
#       option proto            tcp

### FULL CONFIG SECTIONS
#config rule
#       option src              lan
#       option src_ip   192.168.45.2
#       option src_mac  00:11:22:33:44:55
#       option src_port 80
#       option dest             wan
#       option dest_ip  194.25.2.129
#       option dest_port        120
#       option proto    tcp
#       option target   REJECT

#config redirect
#       option src              lan
#       option src_ip   192.168.45.2
#       option src_mac  00:11:22:33:44:55
#       option src_port         1024
#       option src_dport        80
#       option dest_ip  194.25.2.129
#       option dest_port        120
#       option proto    tcp

config rule
    option name 'Allow-SSH'
    option target ACCEPT
    option src 'wan'
    option dest_port '22'
    option proto 'tcp'
    option family 'ipv4'

config rule
        option name 'Allow-http'
        option src              wan
        option dest_port        80
        option target           ACCEPT
        option proto            tcp

 

配置基本完成，作為sta連接到ap，需要不同的加密方式，比如none、wep、wpa、wpa2等，如果僅僅是none、wep格式直接用iw connect即可完成連接，其他的加密方式，則需要用到 wpa_supplicant，使用方法如下：

wpa_supplicant -Dnl80211 -iwlan0 -c/var/run/wpa_supplicant-wlan0.conf -B

-B是后台進行wifi的連接，

-c/etc/wpa_supplicant-wlan0.conf 是要連接的ap的配置信息，比如ssid名，key等；因此再運行這條命令之前需要在/etc目錄下建立wpa_supplicant.conf 文件輸入以下內容：

network{
    ssid=“ssid—name”
    psk=“password”
}

或者用以下命令自動生成這個配置文件

wpa_passphrase "<wifi_ssid>" "<password>" >> /etc/wpa_supplicant.conf

 

openwrt uci會自動調用 wpa_cli 創建該配置文件到/var/run/文件夾，也就是 wpa_supplicant-wlan0.conf 文件，所以openwrt下不需要再另外創建該文件，而且在配置/etc/config/wireless 文件后，會自動更新 wpa_supplicant-wlan0.conf 文件

 

最后可以使用如下命令來查看wifi連接狀態

iw dev wlan0 link

注：wlan0是本人開發板上的wifi設備。

至此，所有連接到openwrt局域網內的設備，均可以通過openwrt訪問上級ap，若是上級ap可以訪問外網，則openwrt局域網內的所有設備均可以訪問外網，相當於openwrt是個無線網卡；

 

以上配置在測試的時候發現有個小問題：

當有線接到openwrt開發板的wan口，並且openwrt的wifi連接到ap的時候，如果使用 wpa_cli disconnect 命令斷開wifi連接，這個時候有線不能上外網；但是如果wan口沒有有線連接的時候，先連接wifi，然后再斷開wifi，再連接有線，有線卻可以連接外網；比較奇葩的問題……

 

簡單的說就是不支持有線和wifi同時連接外網……

具體現象如下：

ping www.baidu.com 或者ping 百度的ip均返回：ping: sendto: Network is unreachable

問題根源：

route命令查看IP路由表信息如下：

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
10.10.10.0      *               255.255.255.0   U     0      0        0 br-lan
192.168.2.0     *               255.255.255.0   U     0      0        0 eth0.1

網關地址都是 * ，貌似沒有網關地址……

於是手動添加網關

route add default gw 192.168.2.1

再用route查看ip表顯示如下：

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         192.168.2.1     0.0.0.0         UG    0      0        0 eth0.1
10.10.10.0      *               255.255.255.0   U     0      0        0 br-lan
192.168.2.0     *               255.255.255.0   U     0      0        0 eth0.1

此時再ping 外網，可以正常工作；

 為了解決這個小問題，可以增加個小腳本 script 來手動切換有線和wifi：

由於openwrt默認的是優先wifi連外網（本人測試環境如此……）所以只需監測wifi的連接和斷開就行：

 

#!/bin/bash

case "$2" in
    CONNECTED)
#        notify-send "WPA supplicant: connection established";
       echo "WPA supplicant: connection established";
        ;;
    DISCONNECTED)
#        notify-send "WPA supplicant: connection lost";
       echo "WPA supplicant: connection lost";
        ;;
esac

再添加運行權限： chmod +x  ./script 

使用  wpa_cli -a /yourpath/script 命令監測wifi連接狀態；

腳本里面信息可以替換為修改網關的指令……

當使用wpa_cli 命令連接或者斷開wifi的時候系統會彈出提示信息，如果是AP測主動斷開，還未測試，不知道會是啥結果……