Archer C7 with qca988x (non -CT); 80211s mesh + AP: How to encrypt the 80211s mesh?

Installing and Using OpenWrt
1

I have two C7 v5 running with 19.07.4 custom build, doing 80211s, and AP (5Ghz, Channel 36) and batman-adv, just fine. But I'm unable to encrypt the 80211s mesh.

My build includes wpad (2019-08-08-ca8c2bd2-4) and libopenssl1.1 (1.1.1g-1) as well as hostapd-common and hostapd-utils (2019-08-08-ca8c2bd2-4).

What I do not get or understand: if, when, and how a user needs hostapd (full) or wpad. As far as I can tell. wpad is "just" a reimplentation by nbd but I can not tell if wpad includes the hostapd stuff for providng AP or not. I would assume yes...

Many users and threads here in to forum only speak about using i.e. wpad-mesh-openssl or wolfssl. For me atm device flash space is no limitation so I can just put in the full packages.
What I also do not know/understand, if for any mesh participation the supplicant part is needed or involved. Please enlighten me :slight_smile:

As there were somehow some issues in the past, I like to ask for confirmation about the current state of support for 19.07.4 for qca988x with mesh+ap + any encrytion and some concrete statement what to set on encryption in config/wireless (and where to find uptodate information what is supported or has limitations), and if I have to use "key" or the "sea-whatsoever" option.
(The issues I read about were the kind of race conditions or crashed driver when mesh and ap were running on the radio and then encryption were enabled. What I cant tell if this applied only on 5 or also on 2.4 Ghz radio devices)

Thanks in advise if you do not just post me a link to an two year old thread here, because I think I read/tried them all :confused: Like I said, the mesh without encryption and "roaming" for clients between the APs with all the VLANs on batman-adv just work fine. The only missing part for me now is encryption on 80211s.

Best,
Bernd

2

The wpad package and binary combines both hostapd and wpa-supplicant functions. When running wpad (as is the default) it is not necessary to install either hostapd or wpa-supplicant separately. A wpad-mesh variant with SSL is needed to encrypt a mesh. The SSL library will install as a dependency. OpenSSL is usually preferred though it is larger.

3

see BATADV (mesh) the best decision? and State of Archer C7 v2 in mid-2020

4

Thanks @mk24!

@Catfriend1 Great! These threads I had not found, I will rebuild later this evening or on the weekend.
(I can relate to the only 100 or 150 MBit/s traffic over the vlans on the switch :confused: I think I will in the near future replace one of the C7 (working as a CPE with NAT and stuff and acting as a "core" router with some x86 or apu board, and reduce the tp-link devices to only wireless APs.)

But could you explain why you removed wpad to repace it with wpad-mesh in BATADV (mesh) the best decision? ? Can I assume that wpad-mesh includes both, the master-station handling AND stuff needed to join the mesh? How do they differ? Whats missing in wpad whats in wpad-mesh?

5

I don't know the details but found out this works by trying it. 802.11s should be handled by the package and batman-adv just uses this "link".