19.3 Wireless

19.3.2.2.1 Requirements

In order to set up a wireless access point with FreeBSD, you need to have a compatible wireless card. Currently, only cards with the Prism chipset are supported. You will also need a wired network card that is supported by FreeBSD (this should not be difficult to find, FreeBSD supports a lot of different devices). For this guide, we will assume you want to bridge(4) all traffic between the wireless device and the network attached to the wired network card.

19.3.2.2.2 Setting it up

First, make sure your system can see the wireless card:

    # ifconfig -a
    wi0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
            inet6 fe80::202:2dff:fe2d:c938%wi0 prefixlen 64 scopeid 0x7 
            inet 0.0.0.0 netmask 0xff000000 broadcast 255.255.255.255
            ether 00:09:2d:2d:c9:50
            media: IEEE 802.11 Wireless Ethernet autoselect (DS/2Mbps)
            status: no carrier
            ssid ""
            stationname "FreeBSD Wireless node"
            channel 10 authmode OPEN powersavemode OFF powersavesleep 100
            wepmode OFF weptxkey 1

Do not worry about the details now, just make sure it shows you something to indicate you have a wireless card installed.

Next, you will need to load a module in order to get the bridging part of FreeBSD ready for the access point. In order to load the bridge(4) module, simply run the following command:

    # kldload bridge

It should not have produced any errors when loading the module. If it did, you may need to compile the bridge(4) code into your kernel. The Bridging section of the handbook should be able to help you accomplish that task.

Now that you have the bridging stuff done, we need to tell the FreeBSD kernel which interfaces to bridge together. We do that by using sysctl:

    # sysctl net.link.ether.bridge=1

    # sysctl net.link.ether.bridge_cfg="wi0 xl0"

    # sysctl net.inet.ip.forwarding=1

Now it is time for the wireless card setup.

The following commands will set the card into BSS mode (turning it into an access point):

    # wicontrol -s "FreeBSD AP" -t 3 -n "my_net"

    # ifconfig wi0 inet up ssid my_net mediaopt hostap

    # wicontrol -p 6

The first wicontrol(8) command tells FreeBSD that the name of this access point is FreeBSD AP by using the -s FreeBSD AP flags, to use auto rate selection at the highest rate (11Mbps) with the -t 3 flags, and the SSID (station ID) is set to my_net with the -n flag. Check out wicontrol(8) for more information.

The ifconfig(8) line brings the wi0 interface up, and sets its SSID to my_net. This is a little redundant, but it is shown here to emphasize that you can do these settings in either place. You will also notice a mediaopt hostap setting; this setting is to tell ifconfig(8) to put the interface into access point mode.

The second wicontrol(8) line turns the interface into access point mode, instead of the default IBSS (ad-hoc) mode.

Now you should have a complete functioning access point up and running. You are encouraged to read wicontrol(8), ifconfig(8), and wi(4) for further information.

It is also suggested that you read the section on encryption that follows.

19.3.2.3.1 Requirements

There is only one real requirement for setting up FreeBSD as a wireless client. You will need a wireless card that is supported by FreeBSD.

19.3.2.3.2 Setting Up A Wireless FreeBSD Client

You will need to know a few things about the wireless network you are joining before you start. In this example, we are joining a network that has a name of my_net, and encryption turned off.

Note: In this example, we are not using encryption, which is a dangerous situation. In the next section, you will learn how to turn on encryption, and why it is important to do so, and why some encryption technologies still do not completely protect you.

Make sure your card is recognized by FreeBSD:

    # ifconfig -a
    wi0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
            inet6 fe80::202:2dff:fe2d:c938%wi0 prefixlen 64 scopeid 0x7 
            inet 0.0.0.0 netmask 0xff000000 broadcast 255.255.255.255
            ether 00:09:2d:2d:c9:50
            media: IEEE 802.11 Wireless Ethernet autoselect (DS/2Mbps)
            status: no carrier
            ssid ""
            stationname "FreeBSD Wireless node"
            channel 10 authmode OPEN powersavemode OFF powersavesleep 100
            wepmode OFF weptxkey 1

Now, we will set the card to the correct settings for our network:

    # ifconfig wi0 inet 192.168.0.20 netmask 255.255.255.0 ssid my_net

Replace 192.168.0.20 and 255.255.255.0 with a valid IP address and netmask on your wired network. Remember, our access point is bridging the data between the wireless network, and the wired network, so it will appear to the other devices on your network that you are on the wired network just as they are.

Once you have done that, you should be able to ping hosts on the wired network just as if you were connected using a standard wired connection.

If you are experiencing problems with your wireless connection, check to make sure that your are associated (connected) to the access point:

    # ifconfig wi0

should return some information, and you should see:

    status: associated

If it does not show associated, then you may be out of range of the access point, do not have encryption on, or possibly have a configuration problem.

19.3.2.4.1 WEP

WEP is an abbreviation for Wired Equivalency Protocol. WEP is an attempt to make wireless networks as safe and secure as a wired network. Unfortunately, it has been cracked, and is fairly trivial to break. This also means it is not something to rely on when it comes to encrypting sensitive data.

It is better than nothing, so here's how to turn on WEP on your new FreeBSD access point:

    # ifconfig wi0 inet up ssid my_net wepkey 0x1234567890 mediaopt hostap

And here's how you turn on WEP on a client:

    # ifconfig wi0 inet 192.168.0.20 netmask 255.255.255.0 ssid my_net wepkey 0x1234567890

Note that you should replace the 0x1234567890 with a more unique key.

19.3.2.4.2 IPsec

ipsec(4) is a much more robust and powerful tool for encrypting data across a network. This is definitely the preferred way to encrypt wireless data over a network. You can read more about ipsec(4) security and how to implement it in the IPsec section of the handbook.

19.3.2.5.1 bsd-airtools

bsd-airtools is a package that includes wireless auditing tools for wep key cracking, access point detection, etc.

bsd-airtools can be installed from the ports collection. Information on installing ports can be found in Chapter 4 of the handbook.

dstumbler is the packaged tool that allows for access point discovery and signal to noise ratio graphing. If you are having a hard time getting your access point up and running, dstumbler may help you get started.

To test your wireless network security, you may choose to use dweputils to help you determine if wep is the right solution to your wireless security needs.

19.3.2.5.2 wicontrol, ancontrol, raycontrol

These are the tools you use to control how your wireless card behaves on the wireless network. In the examples above, we have chosen to use wicontrol(8), since our wireless card is a wi0 interface. If you had a Cisco wireless device, it would come up as an0, and therefore you would use ancontrol(8).

19.3.2.5.3 ifconfig

ifconfig(8) can be used to do many of the same options as wicontrol(8), however it does lack a few options. Check ifconfig(8) for command line parameters and options.

19.3.2.6.1 Access Points

The only cards that are currently supported for BSS (as an access point) mode are devices based on the Prism (or Prism 2, 2.5) chipset. For a complete list, look at wi(4).

19.3.2.6.2 Clients

Almost all 802.11b wireless cards are currently supported under FreeBSD. Most cards based on Prism, Spectrum24, Hermes, Aironet, and Raylink will work as a wireless network card in IBSS (ad-hoc, peer-to-peer, and BSS) mode.