[Bridge] Ethernet+Wireless Bridge?

[Bridge] Ethernet+Wireless Bridge?

["Peter Valdemar Mørch (Lists)"]

Hi,

Sorry for posting again, but I must have been asking the wrong question.

How do I get a bridge with an ethernet and a wireless interface to work?

I see many HOWTOs on the internet using brctl and ifconfig doing what I 
would do with two ethernet interfaces, but I simply have not been
successful using my wireless interface with the ipw3945 driver. Is that 
because of the hardware+driver or is there some magic I'm missing (apart 
from parprouted or iptables, which does work but is not what I want) ?

http://www.linux-foundation.org/en/Net:Bridge#It_doesn.27t_work_with_my_Wireless_card.21
tells me to expect this.

It says:
> FAQ 7.16: It doesn't work with my Wireless card!
> 
> This is a known problem, and it is not caused by the bridge code.
> Many wireless cards don't allow spoofing of the source address. It is
> a firmware restriction with some chipsets. You might find some
> information in the bridge mailing list archives to help.

... HELP! Are the HOWTOs wrong, or is the above FAQ info wrong?

What cards can I buy that are not part of "many wireless cards"? I 
prefer USB hardware but I don't know what to buy.

I got two responses to my last post:
https://lists.linux-foundation.org/pipermail/bridge/2008-April/005797.html
One to use brctl (which doesn't work for me!) and one to run my linux 
bridge under VMware on a windows host (which is not what I want).

I'm wondering about the lack of answers. Am I asking a stupid question? 
Is there any obvious reading I haven't done? Even an answer like "Forget 
it. You'll never get a ethernet/wireless bridge to work under Linux. The 
FAQ should be changed from 'many' to 'all'." would also be helpful, as I 
would stop trying and stop posting! :D

Peter
-- 
Peter Valdemar Mørch
http://www.morch.com

Re: [Bridge] Ethernet+Wireless Bridge?

[John W. Linville]

On Mon, Apr 28, 2008 at 11:25:07AM +0200, "Peter Valdemar Mørch (Lists)" wrote:

> http://www.linux-foundation.org/en/Net:Bridge#It_doesn.27t_work_with_my_Wireless_card.21
> tells me to expect this.
> 
> It says:
> > FAQ 7.16: It doesn't work with my Wireless card!
> > 
> > This is a known problem, and it is not caused by the bridge code.
> > Many wireless cards don't allow spoofing of the source address. It is
> > a firmware restriction with some chipsets. You might find some
> > information in the bridge mailing list archives to help.
> 
> ... HELP! Are the HOWTOs wrong, or is the above FAQ info wrong?

Spoofing the source MAC is actually forbidden by the 802.11 standard.

Bridging between ethernet and wireless is really only possible if
either your host is an access point or you are using a WDS interface
(or both).  The upstream mac80211 code does not currently support
being an access point (although there are patches floating around
that enable it).  IIRC, a patch to enable using WDS has recently
been merged.  Whether or not that is useful depends on what equipment
you have, and honestly I haven't really used it myself.

What is the goal you are trying to achieve?  In many cases it might
be easier for you to simply setup NAT routing between your ethernet
and wireless connections.

John
-- 
John W. Linville
linville@tuxdriver.com

Re: [Bridge] Ethernet+Wireless Bridge?

[Mark S. Mathews]

Heh.  I think the reason most folks think this should 'just work' is  
because: "hey, it's wireless ethernet, right?", wrong.  You can't  
ether-bridge natively across rs232, or bluetooth, or [any one of a  
hundred non-ethernet media]  either.

If your config consists of a STA and an AP, then the most forthright  
solution (not necessarily easy, mind you...takes a bit of tweaking to  
get it right) is to tunnel your ethernet frames across that link.   
I've used vtun for this purpose in the past.

And, as John pointed out, using routing, with or without NAT, is even easier.
Do you _really_ have to have a bridge?

Have fun,
-Mark


Quoting "John W. Linville" <linville@tuxdriver.com>:

> On Mon, Apr 28, 2008 at 11:25:07AM +0200, "Peter Valdemar Mørch  
> (Lists)" wrote:
>
>> http://www.linux-foundation.org/en/Net:Bridge#It_doesn.27t_work_with_my_Wireless_card.21
>> tells me to expect this.
>>
>> It says:
>> > FAQ 7.16: It doesn't work with my Wireless card!
>> >
>> > This is a known problem, and it is not caused by the bridge code.
>> > Many wireless cards don't allow spoofing of the source address. It is
>> > a firmware restriction with some chipsets. You might find some
>> > information in the bridge mailing list archives to help.
>>
>> ... HELP! Are the HOWTOs wrong, or is the above FAQ info wrong?
>
> Spoofing the source MAC is actually forbidden by the 802.11 standard.
>
> Bridging between ethernet and wireless is really only possible if
> either your host is an access point or you are using a WDS interface
> (or both).  The upstream mac80211 code does not currently support
> being an access point (although there are patches floating around
> that enable it).  IIRC, a patch to enable using WDS has recently
> been merged.  Whether or not that is useful depends on what equipment
> you have, and honestly I haven't really used it myself.
>
> What is the goal you are trying to achieve?  In many cases it might
> be easier for you to simply setup NAT routing between your ethernet
> and wireless connections.
>
> John
> --
> John W. Linville
> linville@tuxdriver.com
> _______________________________________________
> Bridge mailing list
> Bridge@lists.linux-foundation.org
> https://lists.linux-foundation.org/mailman/listinfo/bridge
>



Mark S. Mathews

AbsoluteValue Systems      Web:    http://www.linux-wlan.com
721-D North Drive          e-mail: mark@linux-wlan.com
Melbourne, FL 32934        Phone:  321.259.0737
USA                        Fax:    321.259.0286

Re: [Bridge] Ethernet+Wireless Bridge?

["Peter Valdemar Mørch (Lists)"]

Thank you so much for your replies! REALLY!!!!

Mark S. Mathews mark-at-linux-wlan.com |Lists| wrote:
> Heh.  I think the reason most folks think this should 'just work' is
>  because: "hey, it's wireless ethernet, right?", wrong.  You can't 
> ether-bridge natively across rs232, or bluetooth, or [any one of a 
> hundred non-ethernet media]  either.

Ok, thanks! So all the howto's that simply suggest to do brctl and
ifconfig as if there are no problems are simply *wrong*. Glad to get
that cleared up. I thought I was going mad!

> If your config consists of a STA and an AP, then the most forthright
>  solution (not necessarily easy, mind you...takes a bit of tweaking
> to get it right) is to tunnel your ethernet frames across that link.
> I've used vtun for this purpose in the past.
> 
> And, as John pointed out, using routing, with or without NAT, is even
>  easier. Do you _really_ have to have a bridge?

No, I don't _really_ have to. :-) But it annoys me not knowing *why* it
doesn't work, especially with bozos telling me it is easy.

The ADSL / phone line comes into the house in a very impractical place.
I have servers + switch in one place, and some other equipment in
another. I'd like to connect these into a single subnet with a
wireless+ethernet bridge in each island. Sorta like the Linksys Wet 54
claims to do:
http://www.linksys.com/servlet/Satellite?c=L_Product_C2&childpagename=US%2FLayout&cid=1134692497433&pagename=Linksys%2FCommon%2FVisitorWrapper&lid=9743339789B05

 From http://en.wikipedia.org/wiki/Wi-Fi :
> Wireless network bridges connect a wired network to a wireless
> network. This is different from an access point in the sense that an
> access point connects wireless devices to a wired network at the
> data-link layer.

So now I'm still clueless. The Linksys apparatus seems to do what I 
need. It seems not to be an Access Point. Does this mean the Linksys 
above is "using a WDS interface", and does not run as STA?

Honestly, from your emails I can hear it is not easy, but I'm still not
clear whether this is possible under Linux. Apparently it *is* possible
for the Linksys to do it...

Peter
-- 
Peter Valdemar Mørch
http://www.morch.com

Re: [Bridge] Ethernet+Wireless Bridge?

[John W. Linville]

On Mon, Apr 28, 2008 at 05:29:59PM +0200, "Peter Valdemar Mørch (Lists)" wrote:

> The ADSL / phone line comes into the house in a very impractical place.
> I have servers + switch in one place, and some other equipment in
> another. I'd like to connect these into a single subnet with a
> wireless+ethernet bridge in each island. Sorta like the Linksys Wet 54
> claims to do:
> http://www.linksys.com/servlet/Satellite?c=L_Product_C2&childpagename=US%2FLayout&cid=1134692497433&pagename=Linksys%2FCommon%2FVisitorWrapper&lid=9743339789B05

That is a very specialized device and so it is probably using some
form of L2 NAT.  I wonder for example if it even supports multiple
devices attached to it's ethernet port?

As for the scenario you describe, I have something similar at my
location.  I use two wrt54g's running OpenWRT, and I establish WDS
connections between them.

> Honestly, from your emails I can hear it is not easy, but I'm still not
> clear whether this is possible under Linux. Apparently it *is* possible
> for the Linksys to do it...

It is possible on Linux, but not with a mac80211-based device using
a stock kernel.

John
-- 
John W. Linville
linville@tuxdriver.com

Re: [Bridge] Ethernet+Wireless Bridge?

["Peter Valdemar Mørch (Lists)"]

First of all, thank you again for taking the time to consider my
unsubstantiated wishes.

John W. Linville linville-at-tuxdriver.com |Lists| wrote:
> That is a very specialized device and so it is probably using some
> form of L2 NAT.  I wonder for example if it even supports multiple
> devices attached to it's ethernet port?

Ok, my wireless expert friend (a windows guy) was surprised that
bridging between ethernet and wireless wasn't straightforward in linux.
He says it is trivial and works in Windows, supported by this:
http://www.microsoft.com/windowsxp/using/networking/expert/crawford_02april22.mspx
I'll try it next time I get the chance.

> It is possible on Linux, but not with a mac80211-based device using
> a stock kernel.

Ok, I can feel I'm getting stubborn now, and if you are beginning to 
consider me a troll, just don't reply, and I'll bugger off for now!

I just still don't get it. I'll accept that it involves "black magic" in 
Linux but is trivial with Windows or with Linksys. To my surprise.

Otherwise, can you suggest some reading I can do to understand what 
Windows and Linksys does but that Linux can not do with a mac80211-based 
device using a stock kernel? What is "L2 NAT"? Is it acting as an access 
point (Even though other wireless devices can't connect to it)? WDS 
sound to me to have many interoperability problems, that Linksys and 
Windows apparently do not suffer from. I'm still clueless, I'm affraid.

Thanks a lot for your attention whatever the outcome.

Peter
-- 
Peter Valdemar Mørch
http://www.morch.com

Re: [Bridge] Ethernet+Wireless Bridge?

[Srinivas M.A.]

>
>  Ok, my wireless expert friend (a windows guy) was surprised that
>  bridging between ethernet and wireless wasn't straightforward in linux.
>  He says it is trivial and works in Windows, supported by this:
>  http://www.microsoft.com/windowsxp/using/networking/expert/crawford_02april22.mspx
>  I'll try it next time I get the chance.


The ForceCompatibilityMode option is supposed to work with adapters
that don't support promiscuous mode, so I can only guess that it must
be doing L2 NAT, (with proxy ARP).

The equivalent solution on Linux seems like parprouted
(http://www.hazard.maks.net/parprouted/), which also seems to be
packaged for Debian, etc. I haven't used it, just found it searching
for "arp proxy" and linux. But it seems worth a look.

Re: [Bridge] Ethernet+Wireless Bridge?

[John W. Linville]

On Tue, Apr 29, 2008 at 12:29:42PM +0200, "Peter Valdemar Mørch (Lists)" wrote:
> First of all, thank you again for taking the time to consider my
> unsubstantiated wishes.
> 
> John W. Linville linville-at-tuxdriver.com |Lists| wrote:
> > That is a very specialized device and so it is probably using some
> > form of L2 NAT.  I wonder for example if it even supports multiple
> > devices attached to it's ethernet port?
> 
> Ok, my wireless expert friend (a windows guy) was surprised that
> bridging between ethernet and wireless wasn't straightforward in linux.
> He says it is trivial and works in Windows, supported by this:
> http://www.microsoft.com/windowsxp/using/networking/expert/crawford_02april22.mspx
> I'll try it next time I get the chance.

Yes, we all have a friend like that.  I'll try not to speculate on
whether or not your friend is equally as 'knowledgeable' about how
things really work as my Windows-using friends tend to be.  I find
that the "Windows Just Works" mentality breeds (or attracts) a lack
of intellectual curiousity as to "How It Works"...

Unfortunately that article only explains how to turn-on whatever
Windows does (along with some references on what to do if it _does_not_
Just Work), but it doen't go into any technical detail of how Windows
implements it.  Again I assure you that there are technical reasons
why bridging to wireless is not as simple as your friend would seem
to believe it is.

> > It is possible on Linux, but not with a mac80211-based device using
> > a stock kernel.
> 
> Ok, I can feel I'm getting stubborn now, and if you are beginning to 
> consider me a troll, just don't reply, and I'll bugger off for now!
> 
> I just still don't get it. I'll accept that it involves "black magic" in 
> Linux but is trivial with Windows or with Linksys. To my surprise.

It is only 'trivial' in those other cases because someone has written
code to hide the magic.  If I'm not mistaken, current or near-furture
versions of NetworkManager should perform similar magic.  You might
want to see if the version in Fedora 9 can help.

> Otherwise, can you suggest some reading I can do to understand what 
> Windows and Linksys does but that Linux can not do with a mac80211-based 
> device using a stock kernel? What is "L2 NAT"? Is it acting as an access 
> point (Even though other wireless devices can't connect to it)? WDS 
> sound to me to have many interoperability problems, that Linksys and 
> Windows apparently do not suffer from. I'm still clueless, I'm affraid.

Again, I don't know what Windows and Linksys are doing.  As I
suggested, I suspect they are using L2 NAT.  Similar to IP NAT, L2
NAT is a technique for pretending that traffic from other (in this
case L2 aka Ethernet) addresses is actually from you.  I found a
brief discussion of it in section 3.6.2 here:

	http://lwn.net/Articles/145002/

As for WDS, it is the Gold Standard for bridging over wireless.
But as you suggest, for whatever reason many APs (and probably most
end-stations) will not accept WDS frames from just anyone (if they do
so at all).  Given that, it seems an unlikely candidate for the type of
ad-hoc setup that either Windows or the Linksys device is providing.
Still, it is what I would recommend for your (semi-)permanent setup
if the upstream code supported it at this time for your device.
Unfortunately it does not.

For now, my previous recommendation (routing w/ or w/o IP NAT) still
stands as the simplest and best documented approach.  If that does
not appeal to you, I suspect that bridging combined with L2 NAT via
ebtables as described in the URL cited above will work...YMMV.

> Thanks a lot for your attention whatever the outcome.

Good luck!

John
-- 
John W. Linville
linville@tuxdriver.com

Re: [Bridge] Ethernet+Wireless Bridge?

["Peter Valdemar Mørch (Lists)"]

Hi all you wonderful people,

Srinivas M.A. srinivas.aji-at-gmail.com |Lists| wrote:
 > The equivalent solution on Linux seems like parprouted
 > (http://www.hazard.maks.net/parprouted/), which also seems to be
 > packaged for Debian, etc. I haven't used it, just found it searching
 > for "arp proxy" and linux. But it seems worth a look.

Yes, I tried parprouted. It works well within what it promises to do.
But broadcast (e.g. for DHCP!) is not supported. It, in turn suggests to
use dhcrelay to support DHCP with parprouted. But I didn't try that. I
still hadn't given up on getting a bridge to work.

But I have now.

John W. Linville linville-at-tuxdriver.com |Lists| wrote:
> For now, my previous recommendation (routing w/ or w/o IP NAT) still
> stands as the simplest and best documented approach.  If that does
> not appeal to you, I suspect that bridging combined with L2 NAT via
> ebtables as described in the URL cited above will work...YMMV.

I've just purchased a 3Com 3CRUSB10075 based on the zd1211 driver. Like
always with Linux it seems, buying hardware is a pseudo-man-month job
understanding the underlying technologies and so forth. Is the zd1211
driver "good"? No idea. Does it support WDS?  Promiscuous mode? No idea.
Will I ever need either? No idea.

The fact that I'm frustrated is not an indication that I'm less than in
awe of the response and attention I've gotten here. Thanks a bundle. I'm
off to enjoying my 3com with parprouted when it arrives and to
experiment with nat, routing and ebtables just in case.

In respect,

Peter

Re: [Bridge] Ethernet+Wireless Bridge?

[John W. Linville]

On Tue, Apr 29, 2008 at 05:22:49PM +0200, "Peter Valdemar Mørch (Lists)" wrote:
> Hi all you wonderful people,
> 
> Srinivas M.A. srinivas.aji-at-gmail.com |Lists| wrote:
>  > The equivalent solution on Linux seems like parprouted
>  > (http://www.hazard.maks.net/parprouted/), which also seems to be
>  > packaged for Debian, etc. I haven't used it, just found it searching
>  > for "arp proxy" and linux. But it seems worth a look.
> 
> Yes, I tried parprouted. It works well within what it promises to do.
> But broadcast (e.g. for DHCP!) is not supported. It, in turn suggests to
> use dhcrelay to support DHCP with parprouted. But I didn't try that. I
> still hadn't given up on getting a bridge to work.
> 
> But I have now.

Discussion of parprouted is probably off-topic here, but I'm glad
someone mentioned it because I didn't know about it.  I have, however,
been manually using the techniques it seems to use for some time to
good effect.

I have had trouble getting either dhcrelay or dhcp-fwd to work in
this kind of environment.  If you figure-out how to make it work,
let me know!  I suspect that the authors of those utilities did not
anticipate that sort of usage, and therefore are not using APIs that
direct outgoing frames appropriately.  However, I could be wrong --
I haven't dug very deeply.

> John W. Linville linville-at-tuxdriver.com |Lists| wrote:
> > For now, my previous recommendation (routing w/ or w/o IP NAT) still
> > stands as the simplest and best documented approach.  If that does
> > not appeal to you, I suspect that bridging combined with L2 NAT via
> > ebtables as described in the URL cited above will work...YMMV.
> 
> I've just purchased a 3Com 3CRUSB10075 based on the zd1211 driver. Like
> always with Linux it seems, buying hardware is a pseudo-man-month job
> understanding the underlying technologies and so forth. Is the zd1211
> driver "good"? No idea. Does it support WDS?  Promiscuous mode? No idea.
> Will I ever need either? No idea.

Unfortunately, I don't think you will see any different (or at least
not better) behavior with that driver either -- it is also based
on mac80211.

> The fact that I'm frustrated is not an indication that I'm less than in
> awe of the response and attention I've gotten here. Thanks a bundle. I'm
> off to enjoying my 3com with parprouted when it arrives and to
> experiment with nat, routing and ebtables just in case.

Good plan... :-)

John
-- 
John W. Linville
linville@tuxdriver.com

Re: [Bridge] Ethernet+Wireless Bridge?

[Nicolas]

John W. Linville a écrit :
> 
> Spoofing the source MAC is actually forbidden by the 802.11 standard.

My two cents :

We all agree about the fact that most current wireless implementations 
do not permit spoofing the source MAC, probably for many good and 
several bad reasons.

But wouldn't it be possible, as a temporary and dirty fix, to simply 
send any outgoing frames with the wireless interface MAC as the source 
MAC when the bridge send on a wireless interface ?

Of course, this breaks the bridge transparency principle and might cause 
serious problem with BPDU, but on a simple (or simpler) configuration, 
without STP, this might work well for most level 3+ services. For 
example, an ARP answer can come for a different source MAC than the one 
stated in the ARP payload. So ARP should work well, even if the source 
MAC might look strange for someone having a close look at the frame.

Also, the bridge global MAC (of br0) might be forced to the MAC of the 
wireless interface if there is only a single wireless interface in the 
bridge, probably causing BPDU to work well too.

This is only theoretical and - I admit - a very dirty fix into the 
bridge code, but... better than noting. And by the way, may be this can 
be setup using ebtable, which is cleaner !

Any comments ?

	Nicolas.

Re: [Bridge] Ethernet+Wireless Bridge?

[John W. Linville]

On Fri, May 02, 2008 at 02:04:27PM +0200, Nicolas wrote:
> John W. Linville a écrit :
> > 
> > Spoofing the source MAC is actually forbidden by the 802.11 standard.

> But wouldn't it be possible, as a temporary and dirty fix, to simply 
> send any outgoing frames with the wireless interface MAC as the source 
> MAC when the bridge send on a wireless interface ?

Having given this almost no thought, I suppose it might be possible to
make it 'work' (for some definition of 'work'), in combination with
routing and proxy ARP.  Of course if you are going to route anyway,
it is hard to see why you would need to bridge.

John
-- 
John W. Linville
linville@tuxdriver.com