Setting up authenticated mesh with wpad-mesh

My mesh link worked perfectly fine on a windows machine without that, but when I tried it on a linux box, for some reason I couldn't get a connection, so I added mesh0 to the lan ifname and that fixed it.

I thought the problem might be IPv4 / IPv6 related, or possibly dhcp, I guess there's probably something wrong elsewhere in my config.

I finally got it to work with wpad-mesh-openssl

Details here: https://github.com/openwrt/mt76/issues/72#issuecomment-462600670

2 Likes

On 18.06.x or Snapshots?

On 18.06.2

Can you please post your final network/wireless config as an example? Thank you in advance.

802.11s appears to be broken on master

I'll post here, as well as here. No BATMAN, no OLSR, just pure 802.11s.

/etc/config/network:

config interface 'loopback'
	option ifname 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'some ula_prefix'

config interface 'lan'
	option type 'bridge'
	option ifname 'eth0.1'
	option proto 'static'
	option ipaddr '192.168.0.151'
	option netmask '255.255.255.0'
	option gateway '192.168.0.1'
	list dns '200.12.232.4'
	list dns '200.12.229.1'
	list dns '8.8.8.8'
	option ip6assign '60'

config device 'lan_dev'
	option name 'eth0.1'
	option macaddr 'macaddrX'

config interface 'wan'
	option ifname 'eth0.2'
	option proto 'dhcp'

config device 'wan_dev'
	option name 'eth0.2'
	option macaddr 'macaddrY'

config interface 'wan6'
	option ifname 'eth0.2'
	option proto 'dhcpv6'

config switch
	option name 'switch0'
	option reset '1'
	option enable_vlan '1'

config switch_vlan
	option device 'switch0'
	option vlan '1'
	option ports '0 1 6t'

config switch_vlan
	option device 'switch0'
	option vlan '2'
	option ports '4 6t'

/etc/config/wireless:

config wifi-device 'radio0'
	option type 'mac80211'
	option channel '6'
	option hwmode '11g'
	option path 'platform/10300000.wmac'
	option htmode 'HT20'
	option disabled '0'

config wifi-iface 'default_radio0'
	option device 'radio0'
	option network 'lan'
	option mode 'ap'
	option ssid 'ssid_name'
	option encryption 'psk2'
	option key 'ssid_password'

config wifi-iface 'mesh'
	option device 'radio0'
	option network 'lan'
	option mode 'mesh'
	option mesh_id 'mesh_name'
	option mesh_fwding '1'
	option encryption 'psk2/aes'
	option key 'mesh_password'

I hope this helps others.

Now that I got it working on very cheap ZBT WE1226 AP's, I'd like to try it on dual radio AP's, having the mesh on one frequency, and the AP's on the other.

1 Like

So this on both sides should be enough to run the mesh like a wds ap + client before, since youre not using batman/olsr?

802.11s mesh routing only routes mesh participants, not clients connected to the APs. To route those clients you likely need to:

  • Provide a additional or different routing protocol using the 802.11s mesh, such as
    • batman-adv
    • OLSR
    • gretap tunneling
  • Increase the MTU of the wireless to support the overhead of the routing / tunneling protocol
1 Like

I think I'm acheiving routing by bridging the 'mesh' network into the lan. I'll test it under load later today.

1 Like

I would think so. I haven't found any proper documentation on option mesh_fwding, but this here seems to be a good hint:

option mesh_fwding '0' # Disables the 802.11s own routing! IMPORTANT! Because we currently use OLSR !

So, conversely, if you want the "802.11s own routing", you need to set option mesh_fwding '1'

1 Like

Are you saying that if I add the AP and Mesh on the "lan" bridge, can not the clients connect?

I've tested it with about 10 devices connecting to the remote AP's, streamed videos and movies on a Fire Stick and a Chromecast, and everything works fine.

I've read somewhere about disabling the Spanning Tree protocol on the bridge, but I'm not sure how to do that on my configuration, or if it's even necessary.

So the routing of the 802.11s protocol can also with the traffic of the AP and the clients?

It's working for me!

Here is some Freifunk notes on the topic ```
mesh_fwding='0'



https://jenkins.kbu.freifunk.net/files/node-config/doc/

It is from a script. Node-Config


6.2. Using IEEE 802.11s

You can use the new IEEE 802.11s mesh mode instead of the new ad-hoc. To do so, you need to modify wireless.sh .

Modication to wireless.sh - example for radio0 (first radio, 2.4 Ghz usually).

# ...
        set wireless.wifi_mesh='wifi-iface'
        set wireless.wifi_mesh.device='radio0'
        set wireless.wifi_mesh.network='mesh babel_mesh'
        set wireless.wifi_mesh.mode='mesh'
        set wireless.wifi_mesh.mesh_id='42:42:42:42:42:42'
        set wireless.wifi_mesh_fwding='0'
        set wireless.wifi_mesh.mcast_rate='12000'
# ...

When modifying the 5 Ghz network, use wifi_mesh5 instead of wifi_mesh .

Setting mesh_fwding='0' disables forwarding in the IEEE 802.11s mesh network. Forwarding is disabled , because Babel and batman-adv need to see the topology on their own. Forwarding would hide the structure of network from both babel and batman-adv. In addition, it is redundant to batman-adv.

If experimenting with IEEE 802.11s mesh forwarding:

  1. Disable batman-adv - directly attach the mesh interfaces to the Freifunk bridge
  2. Try to make babeld using the overlay metric
  3. Avoid re-transmitting babel messages - IEEE 802.11s will distribute them anyway.
  4. Happy hacking :-).

Hello has anyone tested wpad-full ? Id like to use full so that I can attempt to configure roaming. In a mesh configuration.

You would have to create two networks: one with 802.11s and another as a simple AP. With the wpad package, the 802.11r option is enabled in the AP, not in the mesh.

Thanks castillofrancodamian . To further clarify my question in order to use 802.11r do I need to have wpad-full installed ? or can I use it with wpad-mesh ? I ask because I created a secure mesh using wpad-mesh but have been unable to using wpad-full, and I want both 802.11s and 802.11r

Yes, you can use wpad-mesh. It also allows to activate the 802.11r protocol for roaming. Ideally, you should use the 802.11s network in 5GHz and the AP in 2GHz if you have a dual band router.
I'm still not sure that the mesh network really is secure because it was mentioned previously (It appears with WEP security).