Bridging: Losing WLAN network connection with 4addr on option - Why?

Question:
For use with my Xen VM, I need to create a virtual network interface (vif) that is bridged to wlan0.

If in /etc/network/interfaces I add

auto xenbr0 iface xenbr0 inet dhcp

And then later do

brctl addif xenbr0 wlan0

I get this error message.

can't add wlan0 to bridge xenbr0: Operation not supported

I found out that Linux won't let you bridge a wireless interface in managed mode at all unless you enable the 4addr option (needed to recompile iw):

iw dev wlan0 set 4addr on

Afterwards

brctl addif xenbr0 wlan0

works, and brctl show shows xenbr0 as bridged to wlan0.

Unfortunately, as soon as I execute

iw dev wlan0 set 4addr on

my entire network connection is gone (no connection). As soon as then I execute

iw dev wlan0 set 4addr off

I reconnect and it works again. If I re-execute 4addr on, it breaks again, if I execute 4addr off, it works again.

Unfortunately, I can't just turn 4addr on, activate the bridge and then turn it back off (error: device not ready).

Does anybody know why I lose my connection ?

2 Answers

Found an answer here:

iw dev wlan0 set 4addr on

However, with 4addr enabled, you're likely to get completely ignored by the AP: association succeeds but all data frames disappear into the ether. This could be for security reasons (because it's damn hard to spoof the source MAC address. Yeah.) In my router (running OpenRG), it's necessary to enable "WDS" mode for the wireless AP interface, add a WDS device restricted to my laptop's MAC address, and add it to the LAN bridge. 4addr packets now work.

There's another problem with this, though – the router now rejects three-address packets from the laptop, which can be rather inconvenient (having to toggle 4addr every time the WLAN network is changed). The workaround is to add, on the laptop, a second wireless interface linked to the same device, but with a different MAC address:

# undo the earlier configuration
iw dev wlan0 set 4addr off
# add a second interface
iw dev wlan0 interface add wds.wlan0 type managed 4addr on
ip link set dev wds.wlan0 addr $ADDR
ip link set dev wds.wlan0 up

Here $ADDR must match the WDS device address configured in the router; other than that, it can be any valid MAC address. The original MAC of wlan0 then remains for "normal" usage.

It's possible to use both wlan0 and wds.wlan0 at the same time – although I've only tested associating to the same AP twice, not to different APs.

Under certain circumstances, you could also use wlan_kabel. It uses packet sockets to directly bridge wlan*-devices with ethernet devices. However, you can only bridge one single MAC at a time with wlan_kabel. It doesn't have the drawback of being barred by access points, because only the original MAC of the wlan device is used.

In your case this would mean, that wlan0 could only be used by one VM and not even by the host.

You can get wlan_kabel here.