Configuring Linux as a Wireless Router (Configure Wireless Card as AP on Separate Network)?

Question

I have a custom built home security system I am working on using Arch Linux, Zoneminder, and a set of Foscam FI9800P wireless IP cameras.

The system being built has a gigabit ethernet port which I would like to use to connect it to the primary home network to access the Zoneminder web UI. It also has a PCIe wireless card which I would like to use to host a completely separate wireless network isolated from the primary network. This network will be used exclusively for the IP cameras to help eliminate bandwidth usage on the primary network.

The issue I'm running into and can't seem to find a solution for is that I can use create_ap to establish an access point but I want it to be a separate network. All resources I've found searching online describe access points only and nothing regarding a wireless router. There are article on the archwiki for creating a router (which I've followed), and internet sharing (which doesn't detail wireless APs) but I can't find anything for this circumstance.

Can anyone help in either pointing to documentation or detailing any methods to use a Linux based PC as a wireless router?

EDIT (For clarification)

It's mainly just the wireless aspect I need info on. I have another computer on my nework set up nearly the same in a hardwired configuration as my home router, were this two ethernet interfaces I'd be golden, it's the wireless AP and getting it working that I'm having the trouble with.

Solution

This is actually much easier than you think, you just need to install and deploy hostapd and dnsmasq.

hostapd transforms your wifi interface into an access point. There is a pre-condition to this, that the wifi card supports AP mode: you test it as follows,

iw list | less
  .....
software interface modes (can always be added):
             * AP/VLAN
             * monitor

If AP appears where it is, then you are good to go. A typical hostapd configuration file, /etc/hostapd/hostapd.conf, looks like this:

interface=wlan0
driver=nl80211
beacon_int=100
hw_mode=g
ieee80211n=1
wme_enabled=1
country_code=US
ssid=MySSID
ieee80211d=1
channel=3
wpa=2
wpa_passphrase=MySuperSecretPassword
wpa_key_mgmt=WPA-PSK
wpa_pairwise=TKIP
rsn_pairwise=CCMP
auth_algs=1
macaddr_acl=0
ignore_broadcast_ssid=0
#logger_syslog=-1
#logger_syslog_level=2
#logger_stdout=-1
#logger_stdout_level=2

This configuration file does not include the statement

bridge=br0

because you indicated no desire to set up a wired component of the LAN, just the wireless one. The bridge is generally used so that the router appears at the same IP address to both wired and wireless clients, and to simplify routing.

The wifi needs an IP address,

ip addr add 192.168.251.1/24 dev wlan0 

and IPv4 forwarding to allow wifi clients to talk to the world. Lastly, you need to setup dnsmasq to setup DHCP and DNS services for your clients. A typical /etc/dnsmasq.conf configuration file looks like this,

domain-needed
bogus-priv
dhcp-authoritative
no-dhcp-interface=eth0
interface=wlan0
server=/someremote.lan/192.168.1.1
local=/my.lan/
server=8.8.8.8
server=8.8.4.4
expand-hosts
domain=my.lan
dhcp-range=192.168.251.32,192.168.251.90,12h
dhcp-host=AA:BB:CC:DD:EE:FF,SomeName,192.168.251.129,12h
dhcp-host=00:11:22:33:44:55,hp-printer,192.168.251.210,12h
dhcp-option=119,my.lan,someremote.lan
dhcp-option=252,"\n"
dhcp-host=AA:11:BB:22:CC:33,ignore
cname=SomeOtherName.my.lan,elastix

where I kept some features which may or may not be of interest to you.

Enable both services via systemctl, make sure the wifi card has an address at boot time, enable MASQUERADING on the internet-connected interface,

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

and you are good to go.

Comments

[FatalKeystroke]

To address your assumptions: -- I don't have a degree or anything but I am very familiar with networking principles and have enough knowledge to do this, I just can't find resources on how to do the wireless access point as an interface to the computer (for which the routing capability is already mostly taken care of). -- The wireless card does have the ability to act in AP mode, I can already get it working as described just not in the way I want. I will take a look ere and play around with this to see if I can get it to solve my problem, thank you.

[AJ Smith 'Smugger']

Can you point me to resources that you already used to get you to where you are at, I will read over them and see if I can help you from there. So did anything I posted help or do I have to scratch that

[FatalKeystroke]

A mashed combination of existing knowledge plus Router - Archwiki, Netctl - Archwiki, Shorewall - Archwiki (Which I previously was unfamiliar with), How to Create an 802.11n AP (Which only gave me an AP to the main network), Software Access Point - Archwiki. -- I'll have to spend some time looking at your link to find out.

[FatalKeystroke]

And sorry about the link dump style, but I got bits and pieces from each.

[FatalKeystroke]

Correction, that's not quite what I need, it's setting up the WAP as an interface which will accept connections from client devices (cameras, and my phone to set up the cameras). It's just the Wireless aspect I can't get working, everything else I'm good on.

[AJ Smith 'Smugger']

Ok, I will go over your links and report back and I will work on finding a solution for you, the problem seems all to simple now to have a complicated answer, but isn't that the way it usually happens... :D

[FatalKeystroke]

That's what I've found in my experience too, I feel it's going to be something small and simple that I just haven't found. Thank you for your help.

[FatalKeystroke]

That works except the IP for the WAP isn't persistent over reboots. I'm having weird behavior now though, it's automatically assigning the WAP with 169.254.156.239/16 at boot time. I can reassign it manually as in your answer but when I set a netctl profile to give it 172.16.0.1 it doesn't persist. Other than that you've solved my problem, thank you very much for the help.

[FatalKeystroke]

Nevermind, I just set Bindsto in the systemd service for hostapd to wait for the network interface and it was good.

[AJ Smith 'Smugger']

Cool, looks as if you got what you needed.