Hi,

Offering cookies for help

I have an odd situation. I'm using a WRT54GL with RC5, I've added nas + tcpdump.

I have all my ports in br0 except the wan port. Pretty stock config.

I have a working WPA wireless connection.

I have a working open WDS connection to an Apple Airport Express. My desired configuration is both AP's talking to one another over WDS, the OpenWRT router handling my internet connection for firewalling and packet shaping, and the clients logging on at either point, all wrapped in (at least) WPA1 protection.

If I enable WPA ('psk') with WDS the airport logs show that it has connected using tkip, and after a short while say the tkip wds has expired. The airport is configured to use the same channel as the linksys client net, but a different SSID (via wl0_wds_ssod) so I can distinguish between which device Im connected to when testing. Everything works fine with an entirely open network - clients on either AP can ping the other.

During the 'successful' WPA connect the airport is unpingable from the linksys and vice versa. After the timeout the airport reports the WDS is down. The Linksys logs show, during bootup, 'wds0.49153 attempt to add interface with same source address' - an issue?

The linksys LAN/Wifi port is 192.168.1.100; the airport 192.168.1.21.

If I enable WPA on the linksys client side and use wl0_wds_akm=open the WDS also fails; not entirely certain why, looking at the hotplug script I've also tried with wd0_wds_crypto="" with no luck; I had thought this would be an intermediate stage of testing, forcing clients to the OpenWRT AP to authenticate, while leaving WDS unprotected. No joy.

The extensive googling and forum reading I've done suggests that with RC5 this should work out of the box; do I still need to extract a nas from a different linksys firmware to get this working?

The airport configuration doesnt permit setting different wavelan data for the WDS link, so is simply configured in non-mac limited mode, with the linksys MAC for WDS in remote station mode. It has the same SSID, Channel + encryption (none, or WPA PSK) as the linksys. Regardless of whether the linksys says AES or TKIP the airport logs say TKIP, and the interface offers no way to choose.

So; it only works if I have a completely open network, but the airport seems to think it successfully attaches to a WDS for a brief while on power up. My question is... *should* this work in any way shape or form?

Thanks for any help

log snippet (Joesephine=airport, takesmack=OpenWRT)

Jul  8 08:48:05 joesephine.skylark.org.uk Joesephine admin: Configuration updated.
Jul  8 08:48:08 joesephine.skylark.org.uk Joesephine dot11: WDS established with station 00:16:b6:19:69:32.
Jul  8 08:48:10 joesephine.skylark.org.uk Joesephine dot11: Rotated TKIP group key.
Jul  8 08:48:11 joesephine.skylark.org.uk Joesephine sys: Initialized (firmware 6.3).
Jul  8 08:48:44 takesmack.skylark.org.uk  dropbear[588]: Child connection from 192.168.1.70:51912
Jul  8 08:48:48 takesmack.skylark.org.uk  dropbear[588]: password auth succeeded for 'root' from 192.168.1.70:51912
Jul  8 08:49:55 joesephine.skylark.org.uk Joesephine dot11: WDS expired with station 00:16:b6:19:69:32.
Jul  8 08:50:28 joesephine.skylark.org.uk Joesephine admin: Connection accepted from fe80::214:51ff:feed:9a3%mirror0/51919.

My wl0 variables follow:

relevant?

wl0_afterburner=off
wl0_akm=psk
wl0_channel=13
wl0_closed=0
wl0_crypto=aes+tkip
wl0_gmode=1
wl0_gmode_protection=off
wl0_infra=1
wl0_maclist=00:30:65:2b:8f:92 00:14:51:72:11:d9 00:14:51:ed:09:a3 00:30:65:1c:a0:73
wl0_macmode=allow
wl0_mode=ap
wl0_ssid=20_Abbey_Court
wl0_wds=00:14:51:72:11:d9
wl0_wds_akm=open
wl0_wds_crypto=
wl0_wds_ssid=20_Abbey_Court_Joesephine
wl0_wds_timeout=0
wl0_wdstimeout=0
wl0_wpa_psk=shorttestkey

full:

wl0_afterburner=off
wl0_akm=psk
wl0_antdiv=-1
wl0_ap_isolate=0
wl0_bcn=100
wl0_channel=13
wl0_closed=0
wl0_corerev=9
wl0_country_code=DE
wl0_crypto=aes+tkip
wl0_dtim=1
wl0_frag=2346
wl0_frameburst=off
wl0_gmode=1
wl0_gmode_protection=off
wl0_hwaddr=00:16:B6:19:69:32
wl0_ifname=eth1
wl0_infra=1
wl0_key=1
wl0_lazywds=0
wl0_maclist=00:30:65:2b:8f:92 00:14:51:72:11:d9 00:14:51:ed:09:a3 00:30:65:1c:a0:73
wl0_macmode=allow
wl0_maxassoc=128
wl0_mode=ap
wl0_mrate=0
wl0_net_mode=mixed
wl0_net_reauth=36000
wl0_phytype=g
wl0_phytypes=g
wl0_plcphdr=long
wl0_radio=1
wl0_radioids=BCM2050
wl0_radius_port=1812
wl0_rate=0
wl0_rateset=default
wl0_rts=2347
wl0_ssid=20_Abbey_Court
wl0_wds=00:14:51:72:11:d9
wl0_wds_akm=open
wl0_wds_crypto=
wl0_wds_ssid=20_Abbey_Court_Joesephine
wl0_wds_timeout=0
wl0_wdstimeout=0
wl0_wep=disabled
wl0_wep_bit=128
wl0_wme=off
wl0_wme_ap_be=15 63 3 0 0 off
wl0_wme_ap_bk=15 1023 7 0 0 off
wl0_wme_ap_vi=7 15 1 6016 3008 off
wl0_wme_ap_vo=3 7 1 3264 1504 off
wl0_wme_no_ack=off
wl0_wme_sta_be=15 1023 3 0 0 off
wl0_wme_sta_bk=15 1023 7 0 0 off
wl0_wme_sta_vi=7 15 2 6016 3008 off
wl0_wme_sta_vo=3 7 2 3264 1504 off
wl0_wpa_gtk_rekey=3600
wl0_wpa_psk=shorttestkey
wl0gpio2=0
wl0gpio3=0
wl0id=0x4320

(Last edited by SockToy on 8 Jul 2006, 21:21)

You need something else than NAS on you access point to make WPA work, i know that it is not easy.

look for WPA-supplicant, this package will help you to configure WDS with WPA.
There's some tutorials on internet for this

Don't listen to Teka.
As shown on the following pages nas is the package that is needed for WPA encryption on devices with broadcom wireless chipsets.
http://wiki.openwrt.org/OpenWrtDocs/nas
http://wiki.openwrt.org/OpenWrtDocs/Con … 4840eb7144

Unfortunately I can't help with your issue, I haven't used an Airport Express for WDS networks.

Ok you re right
I ll try it!! it s interesting

Well, I decided to give up. I'm using 128bit WEP and IPSec now. Hurrah

If anyone works out what I need to do to get WPA working please do let me know

i think that you can so+lve your problem using wpa psk also for the WDS, remember to set  a different psk for client and wds because if they have the same it does not work (for me).
I use aes on wds and tkip client side, and it work perfectly,

just set
wl0_wds_crypto = aes
wl0_wds_akm = psk
and wl0_wds_psk = shotbutdifferent

(use a 11 digit pass for both)