Category: SysAdmin

Recently I wanted to set up a wireless network bridge between my garage and house without running any Ethernet cables. To do this I purchased a TP-Link TL-WR841ND 300Mbps Wireless N Router with hopes that it could talk to my existing router/access point in the house. The TP-Link supports a mode called WDS which enables bridging two or more wireless LANs.

When WDS is enabled, it causes the remote access point to act as a bridge for both wired and wireless clients. This way a network can easily be expanded without a lot of trouble of extra wiring. Wireless clients can connect to the remote access point and benefit by the increased wireless coverage area as well.

I first tried associating the garage router with my existing TP-Link DSL modem/router, but it turns out that a remote bridge must connect using WEP encryption instead of WPA2, so that wasn’t secure enough for my desires. Testing using WEP showed the bridge working exactly as expected.

To get WPA2 encryption working, I tried associating the remote access point with a 2wire router also in the house. The WDS connection was established, but the firewall in the 2wire would not allow connections to any devices other than the access point.

So in an attempt to combine the two methods, I purchased a second TL-WR841ND wireless router to live in the house and provide the final hop to the Internet for the remote access point.

To set up the network, I first connected the new house access point directly to a computer with an Ethernet cable, opened http://192.168.1.1/ on a browser, and made the following configuration changes:

• Under the DHCP tab, select Disable for the DHCP server, then click Save.
• Under the Forwarding -> UPnP tab, click the Disable button.
• Under the Wireless -> Wireless Settings tab, enter the following settings:
  • SSID: name of new (bridge) network
  • Region: enter the appropriate region for your location
  • Channel: enter the number of the least-congested channel in your area
  • Mode: 11bgn mixed
  • Channel Width: Auto
  • Max Tx Rate: 300Mbps
  • Enable Wireless Router Radio: checked
  • Enable SSID Broadcast: checked
  • Enable WDS: unchecked (WDS is only enabled on the remote access point)
  • Click Save
• Under the Wireless -> Wireless Security tab, enter the following settings:
  • SelectWPA-PSK/WPA2-PSK
  • Version: WPA2-PSK
  • Encryption: AES
  • PSK Password: chose a password for your network
  • Group Key Update Period: 0
• Under the Network -> LAN tab, enter an IP address for the new access point, click Save, then click reboot.

Once that was done, I was ready to connect the new house access point into the network using one of the four LAN Ethernet ports on the back of the device. I connected to the new access point using a laptop to verify that everything was working as expected, then moved on to configuring the garage access point.

The garage access point is configured similarly to above, with only a few changes:

• Under the DHCP tab, select Disable for the DHCP server, then click Save.
• Under the Forwarding -> UPnP tab, click the Disable button.
• Under the Wireless -> Wireless Settings tab, enter the following settings:
  • SSID: name of new remote AP network
  • Region: enter the appropriate region for your location
  • Channel: same as house AP
  • Mode: 11bgn mixed
  • Channel Width: Auto
  • Max Tx Rate: 300Mbps
  • Enable Wireless Router Radio: checked
  • Enable SSID Broadcast: checked
  • Enable WDS: checked
  • Click Survey to find the access point created above, click Connect to connect to the house AP
  • Key type: same as house AP
  • Password: same as house AP
  • Click Save
• Under the Wireless -> Wireless Security tab, enter the following settings:
  • SelectWPA-PSK/WPA2-PSK
  • Version: WPA2-PSK
  • Encryption: AES
  • PSK Password: chose a password for your network
  • Group Key Update Period: 0
• Under the Network -> LAN tab, enter an IP address for the new access point, click Save, then click reboot.

I then connected a computer to the garage access point using an Ethernet cable and suddenly, I was online through the bridge. I also tested a wireless connection with the garage AP and was able connect to the Internet using the remote wireless as well.

Now all devices on the network are able to communicate (including wired-only devices in the garage, thanks to the built-in 4-port switch). This enables me to move my extra devices to the garage and remove some noise from the house.

Using WDS ended up being relatively simple, but I must warn you that WDS does not work very well across different vendors (or even different models of the same vendor as I found above). I recommend using all of the same model of access points to have this work best.

Having Bash complete hostnames when SSH’ing to a host is very useful. I use the following on my computers that don’t have useful completion support:

KNOWN_HOSTS_LIST=$(echo `sed -e 's/^  *//' -e '/^#/d' -e 's/[, ].*//' -e '/[/d' ~/.ssh/known_hosts | sort -u`)
complete -W "$KNOWN_HOSTS_LIST" ping
complete -W "$KNOWN_HOSTS_LIST" ssh
complete -W "$KNOWN_HOSTS_LIST" telnet
complete -W "$KNOWN_HOSTS_LIST" traceroute
complete -c -f command sudo
complete -o dirnames cd

If running Debian or Ubuntu, install the bash-completion package to pick up more useful completions.

When the only connection I have into a network is SSH, yet I need to do more work than is possible over a single SSH session, I set up a simple VPN-like solution using the following.

I add to my ~/.ssh/config file:

Host sshgw.example.net
DynamicForward 16000

Host *.example.net
User shane
ProxyCommand ~/.bin/nc-ssh-autoproxy.sh %h %p 16000

The first host listed is the machine where I connect using SSH. I set up a SOCKS proxy on port 16000. The second host section is generic for the entire environment. It specifies a ProxyCommand which calls a script that pipes the SSH connections over the SOCKS proxy when the proxy is up.

Here is the nc-ssh-autoproxy.sh script:

#!/bin/sh
# netcat-openbsd needed for -x proxy option
HOST=$1
PORT=$2
PROXY=$3

netstat -an | grep LISTEN | grep -q "$PROXY"
STAT=$?
if [ $STAT = 1 ] ; then
    /bin/nc $HOST $PORT
else
    /bin/nc -x localhost:$PROXY $HOST $PORT
fi

One thing to note is that you need to have the OpenBSD version of Netcat, not the GNU version. The OpenBSD version supports connecting to SOCKS proxies. If you are using Debian or Ubuntu, install the netcat-openbsd package.

The reason for using the nc-ssh-autoproxy.sh script is that if a SOCKS proxy is not up, the SSH connection goes directly to the host. But if the proxy is running, all new SSH connections use the proxy.

I frequently use the initial SSH connection to open an IRC session. That way I’m not likely to accidentally close it thinking it is an unused terminal and stop the proxy.

A SOCKS proxy is a general solution that you can send web, email, and other traffic through it to the machines behind the SSH gateway. You can set your applications to use the SOCKS proxy on localhost:$PORT and everything should work.

I like to take it a step further though for web browsing: I install FoxyProxy in Firefox and configure FoxyProxy to only send requests for *.example.net through the proxy. All other traffic is sent using the normal methods for the machine.

An example FoxyProxy config:

• Create a new proxy, enable SOCKS5
• Add a new pattern
• Name the pattern
• Provide a URL pattern (I prefer regular expression patterns; here’s an example: https?://.*.example.net(:d+)?/.*)