27.3 Wireless Networking

27.3.3.2.1 Requirements

In order to set up a wireless access point with FreeBSD, you need to have a compatible wireless card. Currently, only cards with the Prism chipset are supported. You will also need a wired network card that is supported by FreeBSD (this should not be difficult to find, FreeBSD supports a lot of different devices). For this guide, we will assume you want to bridge(4) all traffic between the wireless device and the network attached to the wired network card.

The hostap functionality that FreeBSD uses to implement the access point works best with certain versions of firmware. Prism 2 cards should use firmware version 1.3.4 or newer. Prism 2.5 and Prism 3 cards should use firmware 1.4.9. Older versions of the firmware way or may not function correctly. At this time, the only way to update cards is with Windows® firmware update utilities available from your card's manufacturer.

27.3.3.2.2 Setting It Up

First, make sure your system can see the wireless card:

# ifconfig -a
wi0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
        inet6 fe80::202:2dff:fe2d:c938%wi0 prefixlen 64 scopeid 0x7
        inet 0.0.0.0 netmask 0xff000000 broadcast 255.255.255.255
        ether 00:09:2d:2d:c9:50
        media: IEEE 802.11 Wireless Ethernet autoselect (DS/2Mbps)
        status: no carrier
        ssid ""
        stationname "FreeBSD Wireless node"
        channel 10 authmode OPEN powersavemode OFF powersavesleep 100
        wepmode OFF weptxkey 1

Do not worry about the details now, just make sure it shows you something to indicate you have a wireless card installed. If you have trouble seeing the wireless interface, and you are using a PC Card, you may want to check out pccardc(8) and pccardd(8) manual pages for more information.

Next, you will need to load a module in order to get the bridging part of FreeBSD ready for the access point. To load the bridge(4) module, simply run the following command:

# kldload bridge

It should not have produced any errors when loading the module. If it did, you may need to compile the bridge(4) code into your kernel. The Bridging section of this handbook should be able to help you accomplish that task.

Now that you have the bridging stuff done, we need to tell the FreeBSD kernel which interfaces to bridge together. We do that by using sysctl(8):

# sysctl net.link.ether.bridge.enable=1
# sysctl net.link.ether.bridge.config="wi0 xl0"
# sysctl net.inet.ip.forwarding=1

On FreeBSD versions earlier than 5.2, you need to use the following options instead:

# sysctl net.link.ether.bridge=1
# sysctl net.link.ether.bridge_cfg="wi0,xl0"
# sysctl net.inet.ip.forwarding=1

Now it is time for the wireless card setup. The following command will set the card into an access point:

# ifconfig wi0 ssid my_net channel 11 media DS/11Mbps mediaopt hostap up stationname "FreeBSD AP"
        

The ifconfig(8) line brings the wi0 interface up, sets its SSID to my_net, and sets the station name to FreeBSD AP. The media DS/11Mbps sets the card into 11Mbps mode and is needed for any mediaopt to take effect. The mediaopt hostap option places the interface into access point mode. The channel 11 option sets the 802.11b channel to use. The wicontrol(8) manual page has valid channel options for your regulatory domain.

Now you should have a complete functioning access point up and running. You are encouraged to read wicontrol(8), ifconfig(8), and wi(4) for further information.

It is also suggested that you read the section on encryption that follows.

27.3.3.2.3 Status Information

Once the access point is configured and operational, operators will want to see the clients that are associated with the access point. At any time, the operator may type:

# wicontrol -l
1 station:
00:09:b7:7b:9d:16  asid=04c0, flags=3<ASSOC,AUTH>, caps=1<ESS>, rates=f<1M,2M,5.5M,11M>, sig=38/15

This shows that there is one station associated, along with its parameters. The signal indicated should be used as a relative indication of strength only. Its translation to dBm or other units varies between different firmware revisions.

27.3.3.3.1 Requirements

There is only one real requirement for setting up FreeBSD as a wireless client. You will need a wireless card that is supported by FreeBSD.

27.3.3.3.2 Setting Up a Wireless FreeBSD Client

You will need to know a few things about the wireless network you are joining before you start. In this example, we are joining a network that has a name of my_net, and encryption turned off.

Make sure your card is recognized by FreeBSD:

# ifconfig -a
wi0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
        inet6 fe80::202:2dff:fe2d:c938%wi0 prefixlen 64 scopeid 0x7
        inet 0.0.0.0 netmask 0xff000000 broadcast 255.255.255.255
        ether 00:09:2d:2d:c9:50
        media: IEEE 802.11 Wireless Ethernet autoselect (DS/2Mbps)
        status: no carrier
        ssid ""
        stationname "FreeBSD Wireless node"
        channel 10 authmode OPEN powersavemode OFF powersavesleep 100
        wepmode OFF weptxkey 1

Now, we can set the card to the correct settings for our network:

# ifconfig wi0 inet 192.168.0.20 netmask 255.255.255.0 ssid my_net

Replace 192.168.0.20 and 255.255.255.0 with a valid IP address and netmask on your wired network. Remember, our access point is bridging the data between the wireless network, and the wired network, so it will appear to the other devices on your network that you are on the wired network just as they are.

Once you have done that, you should be able to ping hosts on the wired network just as if you were connected using a standard wired connection.

If you are experiencing problems with your wireless connection, check to make sure that you are associated (connected) to the access point:

# ifconfig wi0

should return some information, and you should see:

status: associated

If it does not show associated, then you may be out of range of the access point, have encryption on, or possibly have a configuration problem.

27.3.3.4.1 WEP

WEP is an abbreviation for Wired Equivalency Protocol. WEP is an attempt to make wireless networks as safe and secure as a wired network. Unfortunately, it has been cracked, and is fairly trivial to break. This also means it is not something to rely on when it comes to encrypting sensitive data.

It is better than nothing, so use the following to turn on WEP on your new FreeBSD access point:

# ifconfig wi0 inet up ssid my_net wepmode on wepkey 0x1234567890 media DS/11Mbps mediaopt hostap

And you can turn on WEP on a client with this command:

# ifconfig wi0 inet 192.168.0.20 netmask 255.255.255.0 ssid my_net wepmode on wepkey 0x1234567890

Note that you should replace the 0x1234567890 with a more unique key.

27.3.3.4.2 IPsec

ipsec(4) is a much more robust and powerful tool for encrypting data across a network. This is definitely the preferred way to encrypt data over a wireless network. You can read more about ipsec(4) security and how to implement it in the IPsec section of this handbook.

27.3.3.5.1 The bsd-airtools Package

The bsd-airtools package is a complete toolset that includes wireless auditing tools for WEP key cracking, access point detection, etc.

The bsd-airtools utilities can be installed from the net-mgmt/bsd-airtools port. Information on installing ports can be found in Chapter 4 of this handbook.

The program dstumbler is the packaged tool that allows for access point discovery and signal to noise ratio graphing. If you are having a hard time getting your access point up and running, dstumbler may help you get started.

To test your wireless network security, you may choose to use “dweputils” (dwepcrack, dwepdump and dwepkeygen) to help you determine if WEP is the right solution to your wireless security needs.

27.3.3.5.2 The wicontrol, ancontrol and raycontrol Utilities

These are the tools you can use to control how your wireless card behaves on the wireless network. In the examples above, we have chosen to use wicontrol(8), since our wireless card is a wi0 interface. If you had a Cisco wireless device, it would come up as an0, and therefore you would use ancontrol(8).

27.3.3.5.3 The ifconfig Command

The ifconfig(8) command can be used to do many of the same options as wicontrol(8), however it does lack a few options. Check ifconfig(8) for command line parameters and options.

27.3.3.6.1 Access Points

The only cards that are currently supported for BSS (as an access point) mode are devices based on the Prism 2, 2.5, or 3 chipsets. For a complete list, look at wi(4).

27.3.3.6.2 802.11b Clients

Almost all 802.11b wireless cards are currently supported under FreeBSD. Most cards based on Prism, Spectrum24, Hermes, Aironet, and Raylink will work as a wireless network card in IBSS (ad-hoc, peer-to-peer, and BSS) mode.

27.3.3.6.3 802.11a & 802.11g Clients

The ath(4) device driver supports 802.11a and 802.11g. If your card is based on an Atheros chipset, you may be able to use this driver.

Unfortunately, there are still many vendors that do not provide schematics for their drivers to the open source community because they regard such information as trade secrets. Consequently, the developers of FreeBSD and other operating systems are left two choices: develop the drivers by a long and pain-staking process of reverse engineering or using the existing driver binaries available for the Microsoft® Windows platforms. Most developers, including those involved with FreeBSD, have taken the latter approach.

Thanks to the contributions of Bill Paul (wpaul), as of FreeBSD 5.3-RELEASE there is “native” support for the Network Driver Interface Specification (NDIS). The FreeBSD NDISulator (otherwise known as Project Evil) takes a Windows driver binary and basically tricks it into thinking it is running on Windows. This feature is still relatively new, but most test cases seem to work adequately.

In order to use the NDISulator, you need three things:

1. Kernel sources

2. Windows XP driver binary (.SYS extension)

3. Windows XP driver configuration file (.INF extension)

You may need to compile the ndis(4) mini port driver wrapper module. As root:

# cd /usr/src/sys/modules/ndis
# make && make install

Locate the files for your specific card. Generally, they can be found on the included CDs or at the vendors' websites. In the following examples, we will use W32DRIVER.SYS and W32DRIVER.INF.

The next step is to compile the driver binary into a loadable kernel module. To accomplish this, as root, go into the if_ndis module directory and copy the Windows driver files into it:

# cd /usr/src/sys/modules/if_ndis
# cp /path/to/driver/W32DRIVER.SYS ./
# cp /path/to/driver/W32DRIVER.INF ./

We will now use the ndiscvt utility to create the driver definition header ndis_driver_data.h to build the module:

# ndiscvt -i W32DRIVER.INF -s W32DRIVER.SYS -o ndis_driver_data.h

The -i and -s options specify the configuration and binary files, respectively. We use the -o ndis_driver_data.h option because the Makefile will be looking for this file when it comes time to build the module.

Finally, we can build and install the driver module:

# make && make install

To use the driver, you must load the appropriate modules:

# kldload ndis
# kldload if_ndis

The first command loads the NDIS miniport driver wrapper, the second loads the actual network interface. Check dmesg(8) to see if there were any errors loading. If all went well, you should get output resembling the following:

ndis0: <Wireless-G PCI Adapter> mem 0xf4100000-0xf4101fff irq 3 at device 8.0 on pci1
ndis0: NDIS API version: 5.0
ndis0: Ethernet address: 0a:b1:2c:d3:4e:f5
ndis0: 11b rates: 1Mbps 2Mbps 5.5Mbps 11Mbps
ndis0: 11g rates: 6Mbps 9Mbps 12Mbps 18Mbps 36Mbps 48Mbps 54Mbps

From here you can treat the ndis0 device like any other wireless device (e.g. wi0) and consult the earlier sections of this chapter.