Someone said in a recent thread that they stick to wired over wireless because it's just not worth the hassle. Oh, how I wish I could run cable all over this place. Sadly, for now I can't.

Is there someone here who could kindly explain to me how I bridge a Linksys WRT54G (v2, with DD-WRT v23 sp2) to an Apple Airport Extreme? I would be extremely grateful.

Here's the situation: the airport extreme is my main router. I'd like to re-purpose an old WRT54G I have lying around, so I could replace the powerline networking gear I have connected to my home theater. I love that technology but I think I can get better speeds out of 802.11g than I can with the adapters.

So far I've found this handy guide to bridging two WRT54Gs with the DD-WRT firmware, but I haven't the slightest clue where to start on the Airport, and most of my Google searches bring up results where people are either trying to bridge the airport to the Linksys (instead of the other way around), or they're discussing WDS, which is not what I want to do.

Any ideas?

Firstly Bridging != WDS but I think you got that.

I have 2 WRT54Gs at home doing exactly this.

The Airport requires nothing to be changed. It just runs as a normal access point as is, as normal.

On the WRT54G you just need to put it in bridged mode and the associate it with the Airport just like you would a laptop or PC with a wireless card. Look under wireless and select the mode to be "Client Bridge". Then the security settings etc.

Then just plug something ethernet based in the WRT54Gs switch ports and that device magically becomes wireless.

Piece of cake. Let me know if you still need help might be easier on IM or something.

Yeah, I think I might still need help. Everything in your post made sense to me, and all the settings I made on the WRT54G made sense to me, but for some reason it just wasn't happening. It even seemed to find the Airport and connect to it, but I just didn't have internet access on the computer connected to the Linksys.

*edit*
Well, I think I figured out why it's not working, but I can't figure out how to fix it. The issue is that I can't seem to match security settings on both devices, because Apple has a very weird assortment of wireless security settings on the Airport. For example, there's a choice for "WEP (Transitional Security Network)." What's the problem with this? Well, the Airport insists on a 13-digit key when using WEP. Every other device I've seen, however, refuses to let you enter more than 10. That makes no sense.

I've tried the other security modes but it's still clear that the Linksys is unable to connect to the Airport because I'm not able to match the security settings correctly.

Really, forget about WEP completely, and focus efforts on WPA-PSK instead. The keys are simpler, and it has real security (unlike WEP).

The LinkSys side should have a connection status display somewhere, to let you know if it has successfully negotiated or not.

-ml

Believe me, I'm not trying to use WEP. I was just using it as an example of why I'm having trouble with the security side of this, and it's my belief that it's due to Apple doing things differently than everyone else. I'll try to get a screen shot of the options on both routers.


I have a pretty good idea of when it's working or not. When it's not working, for example, the only way I can connect to the Linksys router is if I manually adjust the TCP/IP settings on my NIC so that it has its own IP and will know the address of the gateway. I'm not too familiar with this stuff, but I assume this is because the Linksys can't connect to the Airport and assign my NIC an IP. So that's how I know it's not negotiated.

I've included the screenshots. The first is the Airport, the second two are the Linksys.

If I understand it correctly, clients behind 802.11 wireless bridges cannot use DHCP servers on the other side of the wireless link. If you can assign an IP address to one of these clients manually and have it work, then that's as good as you're going to get. You might be able to set up the AP closest to those clients to provide DHCP addresses, though.

Let me clarify: when there is no wireless security on either device, I can set TCP/IP on my NIC to automatic and I can see the internet and everything just works like normal. When security is on for either device, I can manually set up the NIC, and that will allow me to access the Linksys, but I can't see the internet. So it's not a limitation of the setup, I think it's a problem with mismatched security.

Good info.

Let's simplify the interoperability somewhat: Set both routers to use WPA2-Personal(Pre-Shared Key Only), and AES only. Not WPA/WPA2, just WPA2.

This way we'll eliminate any mis-matches in encryption methods and the like, which have confounded many others before you.

Next, find that status screen (or log) on the Linksys, so that you can know *for certain* exactly what is happening (or not).

Cheers

This is necessary, because two things have to be working for your PC to connect:

(1) the wireless association between the routers, and
(2) the forwarding of IP packets from your PC to the far end.

The status/log info will help track down which part is not working.

Cheers

Okay, I've applied the settings you've suggested (which sound good to me). I'm still in the same situation, though. If DD-WRT has a log I'm not sure where it is, but I've included screenshots of each of the "Status" tabs:

Mmm.. okay, I have a WRT54GS in a box here somewhere, with (I think) DD-WRT on it.

I'll try and replicate your situation, except it'll be bridging to another brand of wireless rather than Apple.

Cheers

Wow! Thanks, I really appreciate it. I do think it's an issue with the security settings on the Airport. I have a wireless photo frame that works perfectly when there is no security on the Airport, but with any type of security the frame can't see my network because it doesn't recognize the type of encryption used. I chalked that up to bad programming on the part of the manufacturer, but I've now tried three different third-party firmwares on the Linksys, and had the same results every time.

Mmm.. no problem with the wireless bridging part -- except there's a choice of bridges in the DD-WRT config: Client Bridge or Repeater Bridge.

Just for fun, I chose Repeater Bridge.

The bridge works, but I cannot figure out how to turn off the DHCP server in the DD-WRT box, so my clients always get a bad DHCP setup from it. If I manually set the IP config, my client talks across the bridge and out just fine.

Anyone see where the "disable DHCP server" config option is hiding?

Cheers

Okay, in DD-WRT, click on the Status tab, and then on the Wireless sub-tab that appears. Then go to the bottom of that screen, and hit Site Survey. Your airport router should appear, so then just click on the Join button to connect to it.

If all goes well, it should show it connecting.

Then back to the Status->Wireless page again, scroll down, and (refresh) it should show the SSID of the airport router, along with Rx/Tx packet info etc..

Mmm..Okay, it does forward the DHCP requests to the far end, which rejects them because the DD-WRT has an "invalid subnet" IP address. So it falls back to serving DHCP itself in that case. Sensible, I suppose, because it does then allow me to connect and fix it. But confusing, too.

Anyway, my fix here, was to just change the static IP of the DD-WRT to be compatible with the subnet at the far end.

My internal net uses 10.0.0.0/24, so I went to Setup->Basic Setup and just put 10.0.0.144 into the Local IP Address field.

It all now works just fine.
You should probably do something similar, if only to prevent the two APs from trying to use the same IP address.. they may both be defaulting to the same value there..

Cheers

So I can enable DHCP on the Linksys, but just give it a different range? If so, it makes sense to me.

I've done that "Site Survey" and "Join" part, and I saw the Airport's SSID and chose it, but it never works after that...

That's odd, I don't see Repeater Bridge, just Client Bridge.

I've included screenshots of what I believe are all the relevant sections in the DD-WRT admin. In the first one, I only just recently changed "Gateway" to a value other than 0.0.0.0 (I'm just fumbling around in the dark here, I think), so I'm sure that isn't right.

The second shot I included just to ask if it should be Gateway or something else.

The rest of the shots.

No, just disable DHCP Server on the Linksys -- it actually did that automatically when I selected "Repeater Bridge" as the base configuration. The part I missed at first though, was to fix the IP address of the Linksys, to be in the same range (subnet) as used by the other router.

Mmm.. well, you're right that the problem is there.

The DD-WRT firmware I'm using here is whatever was current when I got the thing: DD-WRT v24 RC-4 (10/10/07) std.

Cheers

Oh, and I also *disabled* the firewall and SPI stuff.

The WAN-side settings don't matter much, since there is no WAN-side in this configuration. And there's no need/use for a "gateway" either.

Now upgraded to the latest V24_RC6.2 firmware.

And it still has a "repeater bridge" option.
But reportedly that is broken in this version.

Mmmm.. now reverted back to the older one again.

A "repeater bridge" appears to be a "client bridge" that also accepts+bridges wireless clients, as well as wired clients.

AKA, WDS IIRC.

Hmm.... a lot has happened while I was asleep.


Definitely the clients can use DHCP behind the bridge.

My setup is

192.168.1.1 Main Linux firewall/router
192.168.1.2 Access point (WRT54G)
192.168.1.3 WRT54G running in client bridge mode (fixed IP)
192.168.1.13 MythTV box (DHCPing an address from 192.168.1.1

Hmm.. Maybe some screenshots from the airport's security setup?

Actually, the very first attached image in the thread is of the Airport's security setup. There is only one option, and that's what type of encryption to use.

Mark, I just think that the security in use by the Airport is what is causing the problem. If there is no security on the Airport OR the Linksys, everything works perfectly, just as it should. But the second that I try to set up security, it all fails.

Oh, and I'm using DD-WRT version 23 sp2. That would explain why I'm not seeing "repeater bridge." If that truly is WDS, like Tom is suggesting (although there's a whole separate WDS section), then I hear that this severely cuts down on the wireless transmission speed. By half, right?

Another question: should the Linksys have the same SSID as the Airport. I guess it doesn't really matter, since it's not set up (in my case) to share a wireless connection, but I thought I'd make sure.

Oh yeah...


Yes. You don't want that. WDS basically makes one big access point from multiple units at the expense of bandwith. What you're trying to do is just give wireless access to a particular device. I'm sure you want "client bridge".


Unlikely since you say it works without the security. As you said it's a security thing and I agree with that. When connecting to the Airport from another device like a laptop does it tell you anything useful as to security settings etc? TKIP, AES etc etc?

I don't believe so. My wife has used the wireless in our house dozens of times without any problem. The Wii downstairs has no issues connecting to the Airport either, but with the digital photo frame and now the router, I've got a 50% success rate

I checked again, and when I set the NIC to automatically get its settings, and if I remove all security from both devices, everything works perfectly.

I just noticed that on the wireless settings page in the Airport configuration utility, right under the password it says "WPA2 clients can join this network using AES-CCMP." Might that CCMP, whatever it is, be important?

AES+CCMP is generally what is meant by "pure WPA2". The Linksys can handle it just fine. But many other, older wireless devices cannot do AES, so they want TKIP+CCMP instead (I think I got that right). Which a "pure WPA2" box may not support.

Try upgrading your DD-WRT to the V2_RC4 version that I tested with here -- known to work, and all of that.

Cheers

I just had a look at mine running v23 SP2. I am only using WPA, not WPA2.

From memory I couldn't get it bridge properly when using WPA2. I was happy enough with just WPA. So that might be the issue you're having although you're running an even older firmware version.

I'd be at least upgrading to v23 SP2 or try that v24 version Mark suggested. You said you're running v23 SP2 but the screen shot you gave shows only v23. It should say "DD-WRT v23 SP2 (09/15/06) std - build 3932"

And v23 SP2 doesn't seem to support AES-CCMP that I can see.

Weird, I thought I'd gotten sp2. I might try that release candidate later today.

Are you bridging with an Airport, though?

No. Mine are both WRT54Gs. Technically you're not bridging with an Airport either. In your case the Airport is just working as a normal access point.

Make sure you get exactly the same version I used here, as we know that one works.

And we're not really "bridging" -- the linksys is just being an ordinary wireless client here, and it should work with any other router in that mode.

Cheers

Well, I didn't include details, but they're relevant to explain why that doesn't disprove how I understand it to work.

Clients behind an 802.11 bridge are all seen with the same MAC address on the far side, the MAC of the bridge itself. You can get one DHCP address, but since DHCP uses the MAC address as the identifier, you can't have more than one device get a DHCP address, including the bridge itself.

Your situation has exactly one DHCP-acquired address at or behind the bridge.

I think that part of the problem is that you, Mark, are setting up a router, while Dignan is trying to set up a bridge. I get the impression that you have put the "external" IP address of the DD-WRT system in your normal network, but the clients behind it are in a different network. In general, it's possible to make this work, but it's more complicated. Can you make a connection to those clients from your normal network? My gut tells me no.

Well, I got the release candidate, and now everything appears to be working! I guess they didn't have the encryption stuff really worked out correctly in the older releases. I'll have to keep up with the firmware (though I'll probably take the "if it aint broke, don't fix it" approach).

In the end, I still wasn't able to use WPA Personal on the Linksys, even though the Airport was in WPA/WPA2 Personal mode. But the Linksys now has completely different encryption options, including WPA2 Personal (it wasn't there before). That one worked.

Thanks for all your help, everyone. I appreciate the assistance greatly.

Sadly, I was reading the DD-WRT forums last night, and it appears that this is true. There is only one MAC for anything at the bridge and beyond.

The weird thing is that some users have reported being able to plug multiple devices into the WRT54G in bridge mode, while others were only able to plug in one (which is technically how it should work, I guess). I'll know either way in a few minutes, when I plug in my devices downstairs. I'll let you know.

*edit*
Well, it doesn't appear to be working in my setup. The wireless transmission speed isn't very good either.

RFC2131 says a DHCP server "MUST" deal with clients that send a "client identifier", and key off that rather than the MAC address; I don't know whether any common DHCP clients do send their MAC address as a client identifier, but if they do, several of them could DHCP through the same bridge.

Peter

I don't believe I have ever seen a DHCP client that supported that option. But your point remains that it could work. In fact, the bridge could do some packet modification to DHCP packets to help its clients use it transparently. I don't think we'll see that happen, though. It would have been nice if the 802.11 folks could have provided the ability to have multiple MAC addresses going over a single connection.

In theory, it wouldn't have to modify the packets. If it was a "true bridge" and not just an AP/client relationship, the APs could figure out which MAC addresses live on which side of the bridge, and tunnel whole Ethernet frames across the wireless -- for complete transparency even to "dumb" DHCP clients and servers. Again, I've no idea whether this actually happens in practice, but OTOH presumably there's some difference between AP/client and bridge modes, as all those screenshots have them listed separately...?

Peter

The DD-WRT firmware claims to implement "DHCP relay" for purposes like this. Dunno much else about it, though.

Mmm... "client bridge" should be better performance than "repeater bridge". But "repeater bridge" should support multiple MACs without issue.

One thing that might be possible/acceptable, would be to have the DD-WRT run DHCP+NAT for it's local clients, so only one MAC is needed across the wireless bridge. EDIT: that's what "client" mode (no "bridge") does on the DD-WRT. EDIT-2: but not necessary.. see next post.

I may dig mine out again and play some more here now..

No, I had everything (both APs etc..) all together on a single bridged subnet.

Cheers

Okay, still no problems here.

I have my DD-WRT (Linksys WRT54GS_v2) configured as "client bridge" over the wireless, and I now have two wired PCs plugged into it using remote DHCP, and now surfing the internet.

The DD-WRT is relaying everything over WiFi (WPA2-Personal/PSK) to another brand of WiFi access point (AP) in another part of the house, and that AP is wired to the internal LAN here.

A wired server on the internal LAN provides DHCP service for all, and is also the internet gateway for our external DSL connection.

File transfer throughput (NVSv3) to/from a DD-WRT attached PC, to the wired server at the far end, is about 20 mbits/second, which is pretty much what one should expect over a Wireless-G connection (under 50% of the raw 54mbits/sec rate).

Any questions?

Cheers

And just for a proper demo, I now have one of the two remote PC's connected across the bridge to an Empeg with EmpegWebLite running, with the active visuals display and all working.. while at the same time I'm using the other machine to surf, email, and write this posting.

Cheers

Here's the log from the DHCP server across the wireless bridge from the two PCs that are using it for their config:


10.0.0.2 is the wired DHCP server on the far side from the DD-WRT,
10.0.0.[46] are the bridged clients plugged into the DD-WRT, and
10.0.0.144 is the DD-WRT bridge itself, performing the DHCP-relays.

Very slick!

If you are *sure* that it is not working, then that would be the fault of the DHCP server in the airport, not handling the DHCP-relay requests from the DD-WRT.

But you can still use things, if you don't mind having the DD-WRT perform NAT for you. That's the wireless "client" mode of DD-WRT. You'll also then have to enable NAT and DHCP-server on the DD-WRT, but it should all work fine. The airport will see only a single MAC (from DD-WRT), and everyone will still see the internet just fine.

Clients behind DD-WRT will be able to establish connections to clients on the rest of your LAN, but the reverse will not be true -- unless you also set up port forwarding etc.. on the DD-WRT.

EDIT: or perhaps it could all work fine the way you had it, if you just enable DHCP service on DD-WRT. Not sure if it allows that in "client bridge" mode, though.

Cheers

Yeah well I'm not sure how the DHCP stuff works exactly, but it definitely does and with more than one client. I also plug my empeg into the client bridge to put it on the network and occasionally my laptop (to get a hard wired 100Mbit connection to my PVR via the WRT54G's built in switch).

I rely on the MAC address passing through since I have some fixed DHCP assignments.

My entire home network is a single 192.168.1.x subnet.