Buying advice

[mcondarelli]

I need to buy a (possibly inexpensive, but known to work well) USB WiFi adapter to be used to add Access Point / Captive portal capabilities to my Firewall.

I would like to have Dual Band capability 2.4G+5G (I suppose this will raise cost, but that's OK... to a point).

It should also have decent power since I need to use it in-house, possibly with concrete walls to traverse.

Size doesn't matter and neither the number of antennas.

I have choice to connect it to OPNsense firewall (based on FreeBSD) or on some Debian Linux (bookworm) box.
Being able to connect to both would be a plus of course.

I tried perusing Amazon but there are simply too many possibilities and I have difficulty pinpointing the
relevant specs to my needs; advice about chipset and/or brand/model would be very welcome.

TiA!

[morrownr]

Hi @mcondarelli

I tried perusing Amazon but there are simply too many possibilities and I have difficulty pinpointing the
relevant specs to my needs; advice about chipset and/or brand/model would be very welcome.

That is the main reason I started this site a few years ago.

I would like to have Dual Band capability 2.4G+5G (I suppose this will raise cost, but that's OK... to a point).

There are low cost adapters that work well with Linux that are single band, dual band and tri band. You are also asking for good range and that where the cost increases come in. Range is provided by high quality antennas and amps which can driver the price up. It would help if we had a rough idea of the price range that would be acceptable to you. Is $40 USD in budget?

USB WiFi adapter to be used to add Access Point / Captive portal capabilities

Captive portal capabilities sounds like monitor mode and packet capture?

Debian Linux (bookworm) box.

I use Debian 12 along with other distros here. This latest version of Debian includes good support for WiFi out of the box. We may need to do some digging regarding FreeBSD but that can happen as we narrow down the options.

Based on what I see in your message, I think the following chipsets are your best options:

mt7610u (dual band, AC 600)
mt7612u (dual band, AC 1200)
mt7921au (tri band, AXE 3000)

With some answers to my questions, I can provide recommendations for specific adapters and links to known good sellers... including sellers on Amazon.

Cheers,

@morrownr

[mcondarelli]

Thanks @morrownr.

I am in Italy so prices would be in €uro.
My main source of technological stuff is Amazon.it, but I have no constraint there.

I am willing to spend up to ~50€ (or even more, if deemed useful) to have something reliable and somewhat "future-proof" (i.e.: something I won't fill like ditching for a few years).

Captive portal is something handled by OPNsense and it's supposed to let everyone connect but redirect to a login "page" and do some monitoring of actual usage.
I might use it for Guest Network.
It's not mandatory.

I'm looking forward to your recommendations ;)

[morrownr]

I am in Italy so prices would be in €uro.

No problem. I've lived and worked in several places in the world. I can do currencies.

Here is a started recommendation:

Alfa ACHM:

https://www.amazon.it/s?k=Alfa+ACHM&__mk_it_IT=%C3%85M%C3%85%C5%BD%C3%95%C3%91&crid=2SW5LWIICS48G&sprefix=alfa+achm%2Caps%2C191&ref=nb_sb_noss

Why would I recommend this adapter? Based on my testing and experience with it, this adapter has the best range of any WiFi 5 dual band adapter on the market. I have a document showing test results but the test is from 2021 so is a little dated so I do not show this test on the Main Menu:

https://github.com/morrownr/USB-WiFi/blob/main/home/Performance_Comparison.md

You can see from this limited test data that there is a lot of variation in range between various adapters. I have an ACHM. It is not the latest technology but is a 24/7/365 stable adapter that works with the mt7610u in-kernel driver so it is plug and play on distros such as Debian 12. The driver is maintained by Mediatek devs.

"future-proof" (i.e.: something I won't fill like ditching for a few years).

The ACHM is an AC600 adapter. This is not the latest technology but is capable of link speeds of 400 Mbps on 5 GHz so it is capable of pumping packets at speeds that will handle many use cases for probably several years. It is a USB2 adapter. Some might prefer a USB3 adapter for higher speeds but USB3 is not mankind's greatest invention. USB2 is more stable and problem free.

I have some other ideas but it might be better if you look to see what is available and send the links. Alfa has a good reputation of quality adapters that have good range. They are not cheap. Panda also has some good products so searching to see what Alfa and Panda adapters are available might help. All Panda adapters are plug and play on Linux. Not all Alfa adapters are plug and play on Linux but many are.

To get the more future proof adapters, you might lean toward the adapters with the mt7921au chipset. I don't see any adapters with that chipset that have long range at this point but some may appear as that is still a fairly new chipset.

Speaking of new chipsets, the driver for the new mt7925 chipset just went into kernel 6.7 and firmware was added to the repo so we should see new adapters based on the mt7925 at some point this year. That is a WiFi 7 tri band chipset. Support is already in the kernel and we are sitting on our hands waiting for products to hit the market. Things have changed a lot in the USB WiFi adapter market for Linux in the last few years,

@morrownr

[mcondarelli]

Thanks @morrownr,
I am a bit confused though.
The link you sent seem to point to "ALFA Network AWUS*" adapters which are all USB3.
You are speaking about "ALFA Network ACHM*" (USB2) instead.
I saw something like this but I'm unsure it is what you're speaking about.

I see several mt7921au adapters (like this, this or this) on AliExpress; they are inexpensive but I'm unsure about power (at this low price I could even decide to "just try" something).

Please advise.

[morrownr]

@mcondarelli

The link I thought I was sending was to the:

ALFA Network AWUS036ACHM 802.111AC Gamma WiFi Adattatore USB

Not sure what happened with the link. Maybe this will be better:

https://www.amazon.it/ALFA-Network-AWUS036ACHM-802-111AC-Adattatore/dp/B08SJBV1N3/ref=sr_1_1?__mk_it_IT=%C3%85M%C3%85%C5%BD%C3%95%C3%91&crid=2SW5LWIICS48G&keywords=Alfa+ACHM&qid=1704386022&sprefix=alfa+achm%2Caps%2C191&sr=8-1

Regarding the links you sent:

1. I've seen some folks talking about the Fenvi adapter.
2. Link did not work.
3. The EDUP adapter does not have a chipset that I would recommend.

Here is a link to another adapter similar in capability and price to the Fenvi adapter:

https://www.aliexpress.us/item/3256804283254522.html?gatewayAdapt=glo2usa

This Comfast adapter was the first mt7921au based adapter on the market last year. It is called the CF-953AX. I've seen a lot of discussions about it and it seems to get good reviews. It is a very low price adapter so average range is about the best you should expect. It will be plug and play with Debian 12 but unknown currently on FreeBSD. That is a very modern tri band chipset so driver support on FreeBSD might not be in place but I don't really know.

At that price, you could always just give it a try. It can be handy to have an extra plug and play adapter available for other projects. You might want to get one of the L shaped usb adapters or a short extension cable depending on where you intend to use it.

[mcondarelli]

Thanks.
I bought both adapters:

• ALFA Network AWUS036ACHM from Amazon.it
• CF-953AX WiFi 6 USB Adapter 2.4G & 5G AX1800 High Speed USB3.0 from Aliexpress.com

I'll be back (most likely) when they arrive ;)

I think we can close this thread now.

[morrownr]

I'll be back (most likely) when they arrive ;)

Please do come back and give us a report.

Let's leave the thread open if that is okay with you. This site gets about 22,500 hits per week and many that stop by like to read this part of the site and the Issues part of the site to see what is being talked about or to see the latest news. I think this issue has information that might be of interest to others.

Glad you stopped by.

@morrownr

[mcondarelli]

I tried to reply earlier but somehow it got lost.
I'll retry ;)

Thanks for all advice.
Most likely I'll be back asking for help in setup.
Most certainly I'll be back to report my experience with the adapters.

FYI:

• ALFA Network AWUS036ACHM is due to arrive Jan, 9th
• CF-953AX WiFi 6 USB Adapter is said to arrive Jan, 25th

MANY Thanks until then ;)
@mcondarelli

[morrownr]

See you when have had a chance to try the adapters. Remember that both adapters will be plug and play on Debian 12. I see folks that have something in their setup that may cause the adapter to not work and then they mess things up trying to fix many things that are not broken. If either adapter does not immediately come to life, come back here and let us know.

@morrownr

[mcondarelli]

Remember that both adapters will be plug and play on Debian 12.

Please note I am not using a full Debian 12 (i.e.: calamares install).
I'm using netinst without any "Desktop Environment" instead.
Can you confirm both adapters should work without "special treatment"?

[morrownr]

Can you confirm both adapters should work without "special treatment"?

I cannot as I am running only the full Debian 12 here. What you can do is check to see if the firmware files and driver are where they should be. If they are, you should be good to go. Do you know where to check and what to check for?

[mcondarelli]

Problem is "headless server" install is really minimal: no NetworkManager and not even iw (IIRC, I am reinstalling my mini-server now to have a "clean start").
There might be relevant firmware/drivers but handling is confined to ifupdown.
I need to keep cruft to a minimum, but I can install all needed packages... if I know what they are ;)
Specifically: what is recommended network handling suite? NetworkManager? IWD? ifupdown? systemd-networkd?
The last two are installed by default, anything else I need to select explcitly.

[morrownr]

Problem is "headless server" install is really minimal...

I run my RasPi4B headless.

I need to keep cruft to a minimum, but I can install all needed packages... if I know what they are ;)

I have an AP guide on the Main Menu. It is not designed to do exactly what you are doing as far as I can tell but many parts could be useful to you.:

https://github.com/morrownr/USB-WiFi/blob/main/home/AP_Mode/Bridged_Wireless_Access_Point.md

You can see that I only use systemd-networkd, systemd-resolved and hostapd. Take a look and ask questions.

@morrownr

[mcondarelli]

Sorry being a continued PITA

Recommended "ALFA Network AWUS036ACHM" has arrived and I tried setting it up following pointed guide (which is exactly what I was trying to follow with my original Intel PCI adapter).

• I left out all "optional" and "Raspberry" settings.
• I kept "predictable network interfaces" as is (i.e.: enabled)
• My distro did not have NetworkManager installed, so I did not need to disable it.
• My install didn't have iw so I installed it through apt install iw
• I used only "single band" /etc/hostapd/hostapd-WiFi5.conf with following adaptations:
  • use lines marked "mt7610u"
  • change ssid/wpa_passphrase
  • country_code=IT
  • interface=wlx00c0cab2bd76
  • ht_capab=[HT40+][HT40-][GF][SHORT-GI-20][SHORT-GI-40]
  • vht_capab=[SHORT-GI-80][MAX-A-MPDU-LEN-EXP3][RX-ANTENNA-PATTERN][TX-ANTENNA-PATTERN]
• I slightly modified the files in /etc/systemd/network:
  • /etc/systemd/network/10-create-bridge-br0.netdev: no change

    [NetDev]
    Name=br0
    Kind=bridge
    

  • /etc/systemd/network/20-bind-ethernet-with-bridge-br0.network: eth0 -> enp2s0

    [Match]
    Name=enp2s0
    
    [Network]
    Bridge=br0
    

  • /etc/systemd/network/30-config-bridge-br0.network: set fixed IP

    Match]
    Name=br0
    
    [Network]
    #DHCP=yes
    Address=192.168.7.98/24
    Gateway=192.168.7.254
    DNS=192.168.7.254
    

Unfortunately this results in a completely non-functional network I went to server console and hid 20-bind... to restore functionality.

In the non-working state I had:

+ set -e
+ ip l
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: enp2s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel master br0 state UP mode DEFAULT group default qlen 1000
    link/ether 60:02:92:57:66:c1 brd ff:ff:ff:ff:ff:ff
3: enxa0cec8b43055: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000
    link/ether a0:ce:c8:b4:30:55 brd ff:ff:ff:ff:ff:ff
4: br0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000
    link/ether 86:30:4f:c2:54:81 brd ff:ff:ff:ff:ff:ff
5: wlx00c0cab2bd76: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br0 state UP mode DEFAULT group default qlen 1000
    link/ether 00:c0:ca:b2:bd:76 brd ff:ff:ff:ff:ff:ff
6: incusbr0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN mode DEFAULT group default qlen 1000
    link/ether 00:16:3e:54:c8:5c brd ff:ff:ff:ff:ff:ff
+ ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host noprefixroute
       valid_lft forever preferred_lft forever
2: enp2s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel master br0 state UP group default qlen 1000
    link/ether 60:02:92:57:66:c1 brd ff:ff:ff:ff:ff:ff
    inet 192.168.7.213/24 brd 192.168.7.255 scope global dynamic enp2s0
       valid_lft 7162sec preferred_lft 7162sec
3: enxa0cec8b43055: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default qlen 1000
    link/ether a0:ce:c8:b4:30:55 brd ff:ff:ff:ff:ff:ff
4: br0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default qlen 1000
    link/ether 86:30:4f:c2:54:81 brd ff:ff:ff:ff:ff:ff
5: wlx00c0cab2bd76: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br0 state UP group default qlen 1000
    link/ether 00:c0:ca:b2:bd:76 brd ff:ff:ff:ff:ff:ff
    inet6 fe80::2c0:caff:feb2:bd76/64 scope link
       valid_lft forever preferred_lft forever
6: incusbr0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default qlen 1000
    link/ether 00:16:3e:54:c8:5c brd ff:ff:ff:ff:ff:ff
    inet 10.127.15.1/24 scope global incusbr0
       valid_lft forever preferred_lft forever
+ ip r
default via 192.168.7.254 dev enp2s0
10.127.15.0/24 dev incusbr0 proto kernel scope link src 10.127.15.1 linkdown
192.168.7.0/24 dev enp2s0 proto kernel scope link src 192.168.7.213
+ cat /etc/resolv.conf
# This is /run/systemd/resolve/stub-resolv.conf managed by man:systemd-resolved(8).
# Do not edit.
#
# This file might be symlinked as /etc/resolv.conf. If you're looking at
# /etc/resolv.conf and seeing this text, you have followed the symlink.
#
# This is a dynamic resolv.conf file for connecting local clients to the
# internal DNS stub resolver of systemd-resolved. This file lists all
# configured search domains.
#
# Run "resolvectl status" to see details about the uplink DNS servers
# currently in use.
#
# Third party programs should typically not access this file directly, but only
# through the symlink at /etc/resolv.conf. To manage man:resolv.conf(5) in a
# different way, replace this symlink by a static file or a different symlink.
#
# See man:systemd-resolved.service(8) for details about the supported modes of
# operation for /etc/resolv.conf.

nameserver 127.0.0.53
options edns0 trust-ad
search .
+ dir=/etc/systemd/network
++ ls /etc/systemd/network
+ lst='10-create-bridge-br0.netdev
20-bind-ethernet-with-bridge-br0.network
30-config-bridge-br0.network'
+ '[' -n '10-create-bridge-br0.netdev
20-bind-ethernet-with-bridge-br0.network
30-config-bridge-br0.network' ']'
+ for f in $lst
+ cat /etc/systemd/network/10-create-bridge-br0.netdev
[NetDev]
Name=br0
Kind=bridge
+ for f in $lst
+ cat /etc/systemd/network/20-bind-ethernet-with-bridge-br0.network
[Match]
Name=enp2s0

[Network]
Bridge=br0
+ for f in $lst
+ cat /etc/systemd/network/30-config-bridge-br0.network
Match]
Name=br0

[Network]
#DHCP=yes
Address=192.168.7.98/24
Gateway=192.168.7.254
DNS=192.168.7.254
+ ping -c3 192.168.7.254
PING 192.168.7.254 (192.168.7.254) 56(84) bytes of data.
From 192.168.7.213 icmp_seq=1 Destination Host Unreachable
From 192.168.7.213 icmp_seq=2 Destination Host Unreachable
From 192.168.7.213 icmp_seq=3 Destination Host Unreachable

--- 192.168.7.254 ping statistics ---
3 packets transmitted, 0 received, +3 errors, 100% packet loss, time 2042ms
pipe 3

Apparently problem is IP address is still at enp2s0 as given by DHCP and not at br0 (which should be fixed).

Where did I goof?

Note: in the current status I can see my new SSID but I can't connect to it (most likely because I don't get a DHCP response); power seems good (32%) but not as good as my ISP modem/router which is jut beside the adapter (44%).

[morrownr]

Where did I goof?

You are trying to use the AHHM as a 5GHz band AP, right?

[Match]
Name=enp2s0

Change it to:

[Match]
Name=wlx00c0cab2bd76

This is just based on a very quick read.

[mcondarelli]

Done, but I do not understand (system is rebooting now).

Shouldn't I bridge "uplink" (i.e.: my wired Ethernet) with AP?

Where is the link?

Boot complete, at least I'm not locked out this time ;)

mcon@cinderella:~$ ssh root@incus
Linux incus 6.1.0-17-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.69-1 (2023-12-30) x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Mon Jan  8 18:18:54 2024 from 192.168.7.12
root@incus:~# ./dump-net.sh 
+ set -e
+ ip l
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: enp2s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP mode DEFAULT group default qlen 1000
    link/ether 60:02:92:57:66:c1 brd ff:ff:ff:ff:ff:ff
3: enxa0cec8b43055: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000
    link/ether a0:ce:c8:b4:30:55 brd ff:ff:ff:ff:ff:ff
4: br0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000
    link/ether 86:30:4f:c2:54:81 brd ff:ff:ff:ff:ff:ff
5: wlx00c0cab2bd76: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br0 state UP mode DEFAULT group default qlen 1000
    link/ether 00:c0:ca:b2:bd:76 brd ff:ff:ff:ff:ff:ff
6: incusbr0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN mode DEFAULT group default qlen 1000
    link/ether 00:16:3e:54:c8:5c brd ff:ff:ff:ff:ff:ff
+ ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host noprefixroute 
       valid_lft forever preferred_lft forever
2: enp2s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 60:02:92:57:66:c1 brd ff:ff:ff:ff:ff:ff
    inet 192.168.7.213/24 brd 192.168.7.255 scope global dynamic enp2s0
       valid_lft 7027sec preferred_lft 7027sec
    inet6 fe80::6202:92ff:fe57:66c1/64 scope link 
       valid_lft forever preferred_lft forever
3: enxa0cec8b43055: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default qlen 1000
    link/ether a0:ce:c8:b4:30:55 brd ff:ff:ff:ff:ff:ff
4: br0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default qlen 1000
    link/ether 86:30:4f:c2:54:81 brd ff:ff:ff:ff:ff:ff
5: wlx00c0cab2bd76: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br0 state UP group default qlen 1000
    link/ether 00:c0:ca:b2:bd:76 brd ff:ff:ff:ff:ff:ff
6: incusbr0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default qlen 1000
    link/ether 00:16:3e:54:c8:5c brd ff:ff:ff:ff:ff:ff
    inet 10.127.15.1/24 scope global incusbr0
       valid_lft forever preferred_lft forever
+ ip r
default via 192.168.7.254 dev enp2s0 
10.127.15.0/24 dev incusbr0 proto kernel scope link src 10.127.15.1 linkdown 
192.168.7.0/24 dev enp2s0 proto kernel scope link src 192.168.7.213 
+ cat /etc/resolv.conf
# This is /run/systemd/resolve/stub-resolv.conf managed by man:systemd-resolved(8).
# Do not edit.
#
# This file might be symlinked as /etc/resolv.conf. If you're looking at
# /etc/resolv.conf and seeing this text, you have followed the symlink.
#
# This is a dynamic resolv.conf file for connecting local clients to the
# internal DNS stub resolver of systemd-resolved. This file lists all
# configured search domains.
#
# Run "resolvectl status" to see details about the uplink DNS servers
# currently in use.
#
# Third party programs should typically not access this file directly, but only
# through the symlink at /etc/resolv.conf. To manage man:resolv.conf(5) in a
# different way, replace this symlink by a static file or a different symlink.
#
# See man:systemd-resolved.service(8) for details about the supported modes of
# operation for /etc/resolv.conf.

nameserver 127.0.0.53
options edns0 trust-ad
search .
+ dir=/etc/systemd/network
++ ls /etc/systemd/network
+ lst='10-create-bridge-br0.netdev
20-bind-ethernet-with-bridge-br0.network
30-config-bridge-br0.network'
+ '[' -n '10-create-bridge-br0.netdev
20-bind-ethernet-with-bridge-br0.network
30-config-bridge-br0.network' ']'
+ for f in $lst
+ cat /etc/systemd/network/10-create-bridge-br0.netdev
[NetDev]
Name=br0
Kind=bridge
+ for f in $lst
+ cat /etc/systemd/network/20-bind-ethernet-with-bridge-br0.network
[Match]
#Name=enp2s0
Name=wlx00c0cab2bd76

[Network]
Bridge=br0
+ for f in $lst
+ cat /etc/systemd/network/30-config-bridge-br0.network
Match]
Name=br0

[Network]
#DHCP=yes
Address=192.168.7.98/24
Gateway=192.168.7.254
DNS=192.168.7.254
+ ping -c3 192.168.7.254
PING 192.168.7.254 (192.168.7.254) 56(84) bytes of data.
64 bytes from 192.168.7.254: icmp_seq=1 ttl=64 time=2.47 ms
64 bytes from 192.168.7.254: icmp_seq=2 ttl=64 time=2.29 ms
64 bytes from 192.168.7.254: icmp_seq=3 ttl=64 time=2.28 ms

--- 192.168.7.254 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2003ms
rtt min/avg/max/mdev = 2.275/2.345/2.474/0.091 ms
+ ping -c3 ftp.funet.fi
PING ftp.funet.fi (193.166.3.2) 56(84) bytes of data.
64 bytes from ftp.funet.fi (193.166.3.2): icmp_seq=1 ttl=50 time=62.9 ms
64 bytes from ipv4.ftp.funet.fi (193.166.3.2): icmp_seq=2 ttl=50 time=62.3 ms
64 bytes from ftp-old.funet.fi (193.166.3.2): icmp_seq=3 ttl=50 time=63.7 ms

--- ftp.funet.fi ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2003ms
rtt min/avg/max/mdev = 62.338/62.994/63.718/0.565 ms
root@incus:~# brctl show
bridge name	bridge id		STP enabled	interfaces
br0		8000.86304fc25481	no		wlx00c0cab2bd76
incusbr0		8000.00163e54c85c	no		
root@incus:~# 

If I understand correctly, I can still ssh into server because ETH (enp2s0) was not touched.
Ethernet connection keeps failing though.
As said it's likely I don't get an IP address from WiFi client because packets are not routed so DHCP request doesn't get to DHCP server (192.168.7.254, the same as gateway and DNS server)

I seem to be missing some final step.
I see two "wrong" things:

• br0 does not seem to have an IP address
• br0 has only one interface connected.

I will try to revert to "DHCP" in br0, but that doesn't look right.

Many Thanks for your continued support.

[morrownr]

As said it's likely I don't get an IP address from WiFi client because packets are not routed so DHCP request doesn't get to DHCP server (192.168.7.254, the same as gateway and DNS server)

Your lan/internet connectivity is coming in via your ethernet port, correct?

What does the following show?

$ iw dev

[mcondarelli]

Yes I connect to server incus through enp2s0 and incus connects to the Internet using the same device.
I just installed a second ETH adapter (USB) for testing.

root@incus:/etc/network# iw dev
phy#0
	Interface wlx00c0cab2bd76
		ifindex 5
		wdev 0x1
		addr 00:c0:ca:b2:bd:76
		ssid AlfaNet
		type AP
		channel 36 (5180 MHz), width: 80 MHz, center1: 5210 MHz
		txpower 15.00 dBm
		multicast TXQ:
			qsz-byt	qsz-pkt	flows	drops	marks	overlmt	hashcol	tx-bytes	tx-packets
			0	0	758	0	0	0	0	152931		758

[morrownr]

# iw dev
phy#0
	Interface wlx00c0cab2bd76
		ifindex 5
		wdev 0x1
		addr 00:c0:ca:b2:bd:76
		ssid AlfaNet
		type AP
		channel 36 (5180 MHz), width: 80 MHz, center1: 5210 MHz
		txpower 15.00 dBm
		multicast TXQ:
			qsz-byt	qsz-pkt	flows	drops	marks	overlmt	hashcol	tx-bytes	tx-packets
			0	0	758	0	0	0	0	152931		758

That indicates that you likely have a good 5GHz band AP setup. It is using channel 36 with a 80 MHz channel width. Interface type is showing as AP. I would not touch the hostapd.conf or anything else to do with hostapd as it looks correct. I think you said you are able to connect to AlfaNet with a client?

So, if you do not have internet connectivity, the problem is with the networking. My guide is setup for a somewhat more simple setup so I think we just need to figure out what is the problem with the network. I have other work to do for now but will try to find time this evening to look over the details you have posted.

[mcondarelli]

Thanks.
It is evening here (I'm on MET) but I'll surely have a look after dinner.
My "feeling" is we simply miss some command to add "regular" (wired) net to AP.
Currently only AP is on br0 and that doesn't look right (in your guide uplink is connected to br0).

I cannot fully connect to AP from client; IF I read it correctly negotiation is OK, but then DHCP fails to deliver a suitable address and that makes sense because it's on the other side of wired Ethernet.
I could try installing a DHCP server (e.g.: DNSMasq) on incus to see if connection can complete, even without internet connectivity (i.e.: try setting up a NATting A.P.).

[morrownr]

I just checked my guide and my memory was bad. You indeed should use the ethernet interface:

sudo nano /etc/systemd/network/20-bind-ethernet-with-bridge-br0.network

[Match]
Name=eth0

[Network]
Bridge=br0

For eth0, use the ethernet interface that has the lan/internet connectivity. My bad.

[mcondarelli]

This actually makes more sense because adding AP interface to bridge br0 is done in /etc/hostapd/hostapd-WiFi5.conf, stanza:

# Bridge interface
bridge=br0
# WiFi interface
interface=wlx00c0cab2bd76

so only the "other side" need to be linked in br0 setup.

It actually works if I use my second USB Ethernet interface (enxa0cec8b43055).
Neither it nor br0 get an explicit IP address on server incus but this doesn't seem to matter because bridging works and AP clients get their config data from "remote" DHCP server.

OTOH if I use my main Ethernet (enp2s0) interface something goes south and I have two malfunctions:

1. incus server loses network connectivity (in both directions).
2. packets are not forwarded through bridge so AP clients cannot contact DHCP server and connection fails.
   most likely some conflict prevents interface to work as expected, but I don't understand exactly what goes wrong (yet); if you have suggestions... ;)

I would like to sort this because needing a "service interface" just to reach incus doesn't look right (and would conflict with my "final" configuration).

Many Thanks, for the time being.

[morrownr]

You might think about looking at some systemd-networkd docs:

https://manpages.debian.org/bookworm/systemd/systemd-networkd.8.en.html

https://manpages.debian.org/bookworm/systemd-resolved/systemd-resolved.service.8.en.html

The setup I have in my guide is just a very simple setup that works if someone is looking for something simple that is very stable. There are a lot of additional configuration options. Some might be needed to do what you want to do.