BATMAN Mesh Network Bridging

I'm working on a project for a course using batman-adv to set up a mesh network. I am attempting to set up a bridged exit point to a non-batman router and have an entry node for non-batman devices to connect to the network as well. The external router is also my DHCP.

I have been going off the examples here and here. But even copying them verbatim doesn't seem to work

I've managed to get my nodes up and running and they are able to ping each other with batctl. The problem is when I try and set up a bridge, that node no longer is able to and doesn't pass any traffic, despite batctl o still showing the nodes.

I'm not sure if I need to do some firewall magic or set default routes? Maybe even use relayd? My configs for /etc/config/networks are as follows:

Exit Node:

config interface 'nwi_mesh0'
   option ifname 'mesh_base'
   option proto 'batadv'
   option mesh 'bat0'
   option mtu '2304'

config interface 'vlan'
   option type 'bridge'
   option stp '1'
   option ifname 'eth0 bat0'
   option proto 'static'
   option ipaddr '192.168.1.100'
   option netmask '255.255.255.0'
   option delegate '0'

Entry Node:

config iterface 'nwi_mesh0'
   option ifname 'mesh_node0'
   option proto 'batadv'
   option mesh 'bat0'
   option mtu '2304'

config interface 'lan'
   option type 'bridge'
   option ifname 'wlan0'
   option proto 'static'
   option ipaddr '192.168.2.1'
   option netmask '255.255.255.0'

config interface 'bat_bridge'
   option ifname 'wlan0 bat0'
   option type 'bridge'
   option stp '1'
   option proto 'static'
   option ipaddr '192.168.1.200'
   option netmask '255.255.255.0
   option delegate '0'

Intermediate Nodes:

config iterface 'nwi_mesh0'
   option ifname 'mesh_nodeX'
   option proto 'batadv'
   option mesh 'bat0'
   option mtu '2304'

The one thing that I see there is that your "Exit Point" network appears to be on 192.168.1.0/24 and while the "Entry Point" "bat_bridge" is on 192.168.1.0/24 as well, your wireless is on a different subnet, 192.168.2.0/24.

Since your lan/wlan0 is on a different subnet, B.A.T.M.A.N. won't "magically" route it, as far as I know, at least without specific or default routes that involve the subnet that it manages.

Thanks for the quick reply, I amended it to the following but I still have the same issue:

Entry Point:

config iterface 'nwi_mesh0'
   option ifname 'mesh_node0'
   option proto 'batadv'
   option mesh 'bat0'
   option mtu '2304'

config interface 'lan'
   option type 'bridge'
   option ifname 'wlan0'
   option proto 'static'
   option ipaddr '192.168.1.199'
   option netmask '255.255.255.0'

config interface 'bat_bridge'
   option ifname 'wlan0 bat0'
   option type 'bridge'
   option stp '1'
   option proto 'static'
   option ipaddr '192.168.1.200'
   option netmask '255.255.255.0
   option delegate '0'

Hmmm, the bridges still don't "feel" right to me. You've got two different bridges covering one interface. I'm not sure how Linux, in general, and OpenWrt/UCI, in specific handle that.

At least in my configuration, I have a single bridge over the bat0.NNNN interface and, if appropriate, an Ethernet interface in /etc/config/network, with the auto-generated wireless interface being added by OpenWrt / netifd by virtue of the option network declaration in /etc/config/wireless

The bridges are covering the bat0 interface for two separate machines though. Also, I don't suppose you could post your config as an example?

That Wiki page is my de-fanged config :wink:, so I'm wondering where my description missed! Give me a few minutes to sort through my config and refresh my memory on how it all connects.


OK, from the top. I give everything explicit names so that it is very clear (to me, at least) what is what and how the "keys" link things together.

In /etc/config/wireless, name the two radios

config wifi-device 'radio24'
        option type 'mac80211'
        [...]

config wifi-device 'radio5'
        option type 'mac80211'
        [...]

Set up, for clarity, the mesh on the 5 GHz radio, and the client-access AP on the 2.4 GHz radio.

First the mesh (yes, I violated my own rule here with the wifi-iface name being the same string as the ifname).

The option network 'nwi_mesh1' tells netifd to bind the interface when it is created to the matching nwi_mesh1 in /etc/config/network

config wifi-iface 'mesh1'
        option device 'radio5'
        option ifname 'mesh1'
        option network 'nwi_mesh1'
        option mode 'mesh'
        option mesh_fwding '0'
        [...]

Here's one of the client-access APs. Similarly, option network 'vlan100' tells netifd to bind the interface to something called vlan100 in /etc/config/network

config wifi-iface
        option device 'radio24'
        option mode 'ap'
        option network 'vlan100'
        [...]

Now on to /etc/config/network

First, "give" the mesh over to B.A.T.M.A.N. and set its MTU

config interface 'nwi_mesh1'
        option ifname 'mesh1'
        option mtu '2304'
        option proto 'batadv'
#       option routing_algo 'BATMAN_V'
        option mesh 'bat0'

It sounds like things are working for you up through this point if the nodes are aware of each other.

Now, bridge the client AP and a local Ethernet interface over the B.A.T.M.A.N.-managed mesh, give the bridge a static IP address, and give the router, in general, a default route and DNS via a router and host somewhere else.

config interface 'vlan100'
        option type 'bridge'
        option stp '1'
        option ifname 'eth0.100 bat0.100'
        option proto 'static'
        option ipaddr '10.0.0.5'
        option netmask '255.255.255.0'
        option delegate '0'

        option gateway '10.0.0.1'
        option dns '10.0.0.53'

You can do the same without VLANs. Since I have multiple VLANs on each of my hosts, I bind to the pseudo-interface associated with the VLAN rather than direct to bat0 or eth0.

Assuming that the OpenWrt box has routing and DNS declared elsewhere or doesn't need it, and doesn't need connectivity itself to a specific VLAN, (for a guest/IoT network, for example) you can simplify that

config interface 'vlan200'
        option type 'bridge'
        option stp '1'
        option ifname 'bat0.200'
        option proto 'none'
        option auto '1'
        option delegate '0'

Ctrl-F 'jeff'

Oh wow, fancy that! Thanks for writing that guide as it was tremendously helpful. The only info I found missing was setting bat0 with

batctl if add mesh0

and not knowing that my first set of adapters didn't support 802.11s.

I also wanted to ask what purpose did the virtual interfaces in that wiki page serve? I didn't see a clarification and I was unsure if I needed them.

I use separate VLANs for "everything". For example:

  • Management interface
  • Router's "own" access to NTP, DNS, other services (if needed at all -- my border router is elsewhere)
  • Various wireless/wired subnets
    • "Privileged" devices
    • Guest network
    • IoT devices, one VLAN per manufacturer

If you're going to set up VLANs later on, might as well start with the first one as a VLAN. The tag will get stripped off, if needed, at the "exit point" or the appropriate switch.

Hmmm, I don't recall having to set that up -- I believe that the option mesh 'bat0' statement in the config interface 'nwi_mesh1' stanza takes care of that in my config. I believe it keys against the config 'mesh' 'bat0' in the default /etec/config/batman-adv

Alright so I think this might possibly be what I am missing, I never bind for my exit node or entry nod. Would I need to do that as follows for the interface that becomes bat0?

Here is what I mean for my exit node:

/etc/config/wireless:

config wifi-iface
        option device 'radio1'
        option network 'vlan' # This right here
        option mode 'ap' # Not sure if it needs to be a station or ap, but I'll try both

config wifi-iface 'mesh0'
        option device 'radio1'
        option ifname 'mesh_base'
        option network 'nwi_mesh0'
        option mode 'mesh'
        option mesh_fwding '0'
        option mesh_id 'steve_bat'
        option encryption 'psk2+ccmp'
        option sae_password 'lolno'

/etc/config/network:

config interface 'nwi_mesh0'
        option ifname 'mesh_base'
        option proto 'batadv'
        option mesh 'bat0'
        option mtu '2304'

config interface 'vlan'
        option type 'bridge'
        option stp '1'
        option ifname 'eth0 bat0'
        option proto 'static'
        option ipaddr '192.168.1.100'
        option netmask '255.255.255.0'
        option delegate '0'

EDIT: Actually, I just noticed in what I quoted, you were binding the 2.4Ghz non-mesh adapter to the bridge (vlan100) between bat0.xxxx and eth0.xxxx. What would be the purpose of this.

And thanks again for all of your help.

Topology:

There's a mesh that runs B.A.T.M.A.N. Layer 2 routing that uses the 802.11s protocol and has no IP addresses associated with it. Every node gets "bat0" as access to this transport.

Conceptually, that now fades into the background as "bat0" on every node knows how to manage Ethernet-like ARP and route Ethernet-like packets among the nodes.

Now, I need to route several VLANs among nodes and to off-mesh nodes.

OpenWrt and netifd typically set up wireless APs and then bridge them to the identified option network when they come up. At least in my experience, as long as there is a bridge with the proper name set up in /etc/config/network then "it just works".

Wired (Ethernet) interfaces require explicit configuration in /etc/config/network to be added to the bridge.

So, in my case, there are two "types" of VLANs that I end up pushing over the mesh:

  • Management interface -- connects only to off-net hosts, no (direct) access from wireless clients
    • ethX.NNNN bat0.NNNN
    • bridge gets IP address
  • Specific SSID -- no (direct) access to AP
    • bat0.NNNN
    • /etc/config/wireless contains an option network "<named bridge>" entry

If you need wireless clients to be able to access services on the AP, then you would "do both":

  • Specific SSID -- with direct access to AP
    • ethX.NNNN bat0.NNNN
    • /etc/config/wireless contains an option network "<named bridge>" entry
    • bridge gets IP address

I name my bridges in /etc/config/network consistent with the VLAN that is later selected for clarity, as well as for 802.1X "auto-VLAN" should I deploy it in the future. It is the interfaces in the declaration of the bridge that actually "sets" the VLAN -- option ifname 'eth0.100 bat0.100'

Sorry for the slight necro-posting, but I got caught up with the holiday a bit.

So do I need to be creating a vlan on all of my nodes so that they can use my bridged gateway to actually get off of my mesh network then? I have just been getting more confused as I read along.

I guess I have all of the mesh components working other than that. I'm 99.99% sure that my problem has something to do with the bridging. I even tried adding the bridge with brctl with brctl addbr br0then brctl addif br0 eth0 and brctl addif br0 bat0 with no luck as well.