bhyve bhyve (vm-bhyve) networking wlan bridge

Greetings.
I am trying to make a guest VM work with wifi connection.
Nothing too fancy: alpine vm in bhyve, and use wifi to connect to the outside world.
It worked just fine with eth0 connection (meaning connecting to the world using an ethernet cable) but when switching to wlan0 something breaks though.
I tried to create a "switch" in vm-bhyve with wlan0 as the physical device, and also tried to create a custom manually configured bridge (though it seems I did pretty much the same thing as the vm-bhyve switch does: ifconfig bridge0 addm wlan0 addm tap0).
Then I try to udhcpc in alpine to recieve IP. On the host side I see dhcp requests coming from alpine and getting no response.
I believe that would be an extremely simple thing to do and for sure many people did it successfully. I couldn't find the exact threads though. Most of them deal with much more sophisticated configurations than the one that I am looking to use.
Maybe the culprit is the quirks of the wifi driver, or some bugged defaults in vm-bhyve.
I wish I could take away from it some acquired knowledge to be able to debug such things in future.
Thanks in advance.
Here's some useful outputs:

Code:
vm switch info public
local: _netgraph,: bad variable name
------------------------
Virtual Switch: public
------------------------
  type: standard
  ident: vm-public
  vlan: -
  physical-ports: wlan0
  bytes-in: 853886 (833.873K)
  bytes-out: 1411870 (1.346M)

  virtual-port
    device: tap0
    vm: alpine

Code:
ifconfig
em0: flags=8863<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
    options=481249b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,LRO,WOL_MAGIC,VLAN_HWFILTER,NOMAP>
    ether e4:b9:7a:42:10:ae
    media: Ethernet autoselect
    status: no carrier
    nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384
    options=680003<RXCSUM,TXCSUM,LINKSTATE,RXCSUM_IPV6,TXCSUM_IPV6>
    inet6 ::1 prefixlen 128
    inet6 fe80::1%lo0 prefixlen 64 scopeid 0x2
    inet 127.0.0.1 netmask 0xff000000
    groups: lo
    nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
bridge0: flags=8802<BROADCAST,SIMPLEX,MULTICAST> metric 0 mtu 1500
    ether 58:9c:fc:10:bd:73
    id 00:00:00:00:00:00 priority 32768 hellotime 2 fwddelay 15
    maxage 20 holdcnt 6 proto rstp maxaddr 2000 timeout 1200
    root id 00:00:00:00:00:00 priority 32768 ifcost 0 port 0
    groups: bridge vm-switch viid-b36eb@
    nd6 options=9<PERFORMNUD,IFDISABLED>
wlan0: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> metric 0 mtu 1500
    ether dc:8b:28:62:f2:64
    inet 172.21.11.175 netmask 0xfffff800 broadcast 172.21.15.255
    groups: wlan
    ssid "SSID" channel 6 (2437 MHz 11g) bssid e4:38:83:6f:03:04
    regdomain FCC country US authmode WPA2/802.11i privacy ON
    deftxkey UNDEF AES-CCM 2:128-bit powersavemode CAM powersavesleep 100
    txpower 30 bmiss 10 scanvalid 60 protmode CTS wme roaming MANUAL
    parent interface: iwm0
    media: IEEE 802.11 Wireless Ethernet DS/2Mbps mode 11g
    status: associated
    nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
vm-public: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
    ether a6:b1:10:49:47:f5
    id 00:00:00:00:00:00 priority 32768 hellotime 2 fwddelay 15
    maxage 20 holdcnt 6 proto rstp maxaddr 2000 timeout 1200
    root id 00:00:00:00:00:00 priority 32768 ifcost 0 port 0
    member: tap0 flags=143<LEARNING,DISCOVER,AUTOEDGE,AUTOPTP>
            ifmaxaddr 0 port 5 priority 128 path cost 2000000
    member: wlan0 flags=143<LEARNING,DISCOVER,AUTOEDGE,AUTOPTP>
            ifmaxaddr 0 port 3 priority 128 path cost 370370
    groups: bridge vm-switch viid-4c918@
    nd6 options=9<PERFORMNUD,IFDISABLED>
tap0: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> metric 0 mtu 1500
    description: vmnet/alpine/0/public
    options=80000<LINKSTATE>
    ether 58:9c:fc:10:ff:ff
    groups: tap vm-port
    media: Ethernet autoselect
    status: active
    nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
    Opened by PID 6717

Code:
12:23:20.206415 IP (tos 0x0, ttl 64, id 0, offset 0, flags [none], proto UDP (17), length 328)
    0.0.0.0.bootpc > 255.255.255.255.bootps: [udp sum ok] BOOTP/DHCP, Request from 58:9c:fc:04:8c:63 (oui Unknown), length 300, xid 0x25ae424d, secs 1766, Flags [none] (0x0000)
      Client-Ethernet-Address 58:9c:fc:04:8c:63 (oui Unknown)
      Vendor-rfc1048 Extensions
        Magic Cookie 0x63825363
        DHCP-Message Option 53, length 1: Discover
        MSZ Option 57, length 2: 576
        Parameter-Request Option 55, length 7:
          Subnet-Mask, Default-Gateway, Domain-Name-Server, Hostname
          Domain-Name, BR, NTP
        Vendor-Class Option 60, length 12: "udhcp 1.36.1"
        Client-ID Option 61, length 7: ether 58:9c:fc:04:8c:63
 
Bridging isn't going to work with a Wifi interface. That interface has to essentially 'spoof' MAC addresses (bridge = layer 2) and most, if not all, wifi client drivers won't allow this.
 
Does bhyve have a local interface feature, where it provides networking via DHCP between host and guest? If so, you could use PF to set up an NAT between the host and the subnet created by the local interfaces.

I've used this same method to connect via Wifi VMs using VMM on OpenBSD but haven't dipped into bhyve just yet, so my comment is purely theoretical.
 
Does bhyve have a local interface feature, where it provides networking via DHCP between host and guest? If so, you could use PF to set up an NAT between the host and the subnet created by the local interfaces.

I've used this same method to connect via Wifi VMs using VMM on OpenBSD but haven't dipped into bhyve just yet, so my comment is purely theoretical.
That's what I am trying to do now. I've set a pf.conf and dnsmasq DHCP as explained in NAT setup guide.
And it worked! Except dhcp though, but that's fine.
Thanks!
 
depending of your Wifi Access point if it support "repeater bridge" mode then it will allow more than one mac address to connect per client. On regular "AP mode" the connected clients are allowed only single mac address that's why when you bridge your wifi it serve only one mac address. If you are unable to change the AP mode then your only option is to use NAT.

Here's an example of ddwrt router with different wireless modes:

1709644789135.png


For the FreeBSD you can select different wireless lan mode using ifconfig
Code:
wlanmode    mode
           Specify the operating mode for this cloned device.  mode    is one
           of  sta,     ahdemo     (or  adhoc-demo),  ibss  (or  adhoc),    ap (or
           hostap),    wds, tdma, mesh, and monitor.  The operating mode of a
           cloned interface    cannot be changed.  The    tdma mode is  actually
           implemented as an adhoc-demo interface with special properties.
 
depending of your Wifi Access point if it support "repeater bridge" mode then it will allow more than one mac address to connect per client. On regular "AP mode" the connected clients are allowed only single mac address that's why when you bridge your wifi it serve only one mac address. If you are unable to change the AP mode then your only option is to use NAT.

Here's an example of ddwrt router with different wireless modes:

View attachment 18384

For the FreeBSD you can select different wireless lan mode using ifconfig
Code:
wlanmode    mode
           Specify the operating mode for this cloned device.  mode    is one
           of  sta,     ahdemo     (or  adhoc-demo),  ibss  (or  adhoc),    ap (or
           hostap),    wds, tdma, mesh, and monitor.  The operating mode of a
           cloned interface    cannot be changed.  The    tdma mode is  actually
           implemented as an adhoc-demo interface with special properties.
Thanks, I understand a little bit more now. I'll try and experiment with my personal wifi access point
 
Thanks, I understand a little bit more now. I'll try and experiment with my personal wifi access point
It might not be the access point limiting it but also the wifi driver on FreeBSD. It's not a technical limitation, it's the 802.11 specification dictating that wireless devices shouldn't be allowed to impersonate other devices (or whatever the correct term is)
 
Back
Top