Solved How to make WPA-Enterpise Host-based Access Point?

[SevenDayz]

The FreeBSD Handbook has an information how to setting up a FreeBSD access point using the WPA2-PSK.

Chapter 34. Advanced Networking

Advanced networking in FreeBSD: basics of gateways and routes, CARP, how to configure multiple VLANs on FreeBSD, etc

docs.freebsd.org

How to setting up a FreeBSD access point using the WPA-Enterpise? (with RADIUS end certificates)

 

[SirDice]

All the settings are mentioned in hostapd.conf(5). The man page could probably be improved a bit by providing some example configurations though, similar to what wpa_supplicant.conf(5) has for the client-side.

 

[Phishfry]

I have found that hostapd also contains a command line utility for configuration. Very useful when you set debug=x for logging.
hostapd_cli

Setting up WPA2 Enterprise using FreeBSD and hostapd

If WPA personal isnt good enough for you. This document describes setting up a wireless FreeBSD router with WPA2 Enterprise security using hostapd

framkant.org

wpa[23]-enterprise · Issue #46 · pgj/freebsd-wifibox

I tested wifibox on FreeBSD 14-Current with intel AX210ngw wifi card. It works fine wpa2-personal but seems that wpa2-enterprise is not working. Is there any way to use wpa2-enterprise ?

github.com

Chapter 34. Advanced Networking

Advanced networking in FreeBSD: basics of gateways and routes, CARP, how to configure multiple VLANs on FreeBSD, etc

docs.freebsd.org

 

[SevenDayz]

All the settings are mentioned in hostapd.conf(5).

GLOBAL PARAMETERS
The following parameters are recognized:

debug Debugging mode: 0 = no, 1 = minimal, 2 = verbose, 3 = msg
dumps, 4 = excessive.

hostapd -ddd /etc/hostapd.conf
Configuration file: /etc/hostapd.conf
Line 6: DEPRECATED: 'debug' configuration variable is not used anymore

It looks like the man page is a bit outdated.

 

[SevenDayz]

I have found that hostapd also contains a command line utility for configuration. Very useful when you set debug=x for logging.
hostapd_cli

I saw it, but I can't find any documentation about meaning these variables

set <name> <value> = set runtime variables
get <name> = get runtime info

so I can't use hostapd_cli.

Setting up WPA2 Enterprise using FreeBSD and hostapd

If WPA personal isnt good enough for you. This document describes setting up a wireless FreeBSD router with WPA2 Enterprise security using hostapd

framkant.org

Thank you. That's almost my case except for an integrated EAP server.
These days, I set up an Asus access point to work but can't set up the FreeBSD box. The FreeBSD box's Wi-Fi is WEP-protected, not WPA Enterprise.
While reading the README from hostapd, I realized I used symbolic constants from the hostapd.conf(5) like

wpa = WPA-RADIUS

, but in the Handbook, the link above, and the README from hostapd, integer constants were used like

wpa=2

.
Later I can come to the FreeBSD box and check the WiFi.

 

[SevenDayz]

OK, I have checked the WiFi today, and the network is WPA-Enterprise protected.
The error was in the hostapd.conf

wpa = WPA-RADIUS

instead of correcting

wpa=2

.
The FreeBSD Handbook has correct information.

My next quiz is "Why can't the FreeBSD client connect to the RADIUS server?"
Nothing happened to the RADIUS server's log when I tried to connect from my phone.

 

[Phishfry]

These days, I set up an Asus access point to work but can't set up the FreeBSD box.

I am on the fence too. Would rather have WPA3-SAE.
OpenRadius server might be easier from my reading but no experience there.

I dove deep into OpenWRT x86_64 Access Point. Working up from 80211AC to AX with Atheros modules. I moved up from APU1 to APU2 and that made it work very well..
Max speed I see on Atheros 80211N modules on FreeBSD is 108megabit with OpenWRT (physical 80megabit).
I have a bunch of Intel AX modules to test on FreeBSD. I look forward to more speed.

I thought about just buying an Asus AX3000 WAP for 60 bucks used but I like using the custom hardware I have already.

 

[SevenDayz]

I am on the fence too. Would rather have WPA3-SAE.

It depends on your environment. For small offices and homes, I would prefer password protection too. It's easier and doesn't require your attention for a working auth server.
I'm going to use about a dozen APs to cover three floors for 20-30 users. So EAP-TLS is good choice for me.

OpenRadius server might be easier from my reading but no experience there.

I know nothing about it.

I dove deep into OpenWRT x86_64 Access Point. Working up from 80211AC to AX with Atheros modules. I moved up from APU1 to APU2 and that made it work very well..
Max speed I see on Atheros 80211N modules on FreeBSD is 108megabit with OpenWRT (physical 80megabit).

Do you use FreeBSD as a client, not as an AP?