Interfaces: Wireless Networks (INTERNAL)

This page is about setting up a wireless interface in access point mode to create your own WLAN. In this mode, your Laptops and handhelds can connect to your OPNsense without an external access point for home and enterprise environments. For home networks step over step two and don’t setup the 802.1X service in the network settings. For external access point, just create a cabled network (usually Ethernet) and connect the access point to the other end.

Warning

FreeBSD supports wireless adapters in access point (infrastructure) mode, but this functionality is limited to some drivers and there may be some, which do not support all options available via the web interface. Please make sure that you buy a wireless card that is supported to avoid these problems.

Note

This guide requires the FreeRADIUS plugin to be installed and enabled (via System ‣ Firmware ‣ Plugins and Services ‣ FreeRADIUS ‣ General) .

Configuration

Step 1

Create a wireless clone interface and assign it.

Step 2 - Prepare RADIUS

../../_images/interface_wireless_radius_2.png

Create a new client, which is the AP. For example, name it localhost, choose a secret and the CIDR 127.0.0.0/8. The secret is later used in the wireless settings.

../../_images/interface_wireless_radius_4.png

Next, switch to the users menu and create a new user (for example for yourself). The username and the password are used to authenticate later. The rest of the settings can be left on their defaults.

Step 3 - Prepare WLAN

../../_images/interface_wireless_radius_1.png

Enable	Check
Description	WLAN
IPv4 Configuration Type	Static IPv4

IPv4 address	A network
IPv4 Upstream Gateway	WLAN

Persist common settings	Check (save for all clones)
Standard	802.11g or another standard your adapter supports
Regulatory settings	Choose your country
Mode	Access Point
SSID	Name of the wireless network
WEP	Unchecked
WPA	Checked with your PSK (WLAN password if wanted)
WPA Mode	WPA2
WPA Key Management Mode	Extensible Authentication
Authentication	Open System Authentication
WPA Pairwise	AES
Enable IEEE802.1X Authentication	Check if you want to use RADIUS authentication
802.1X Server IP Address	127.0.0.1 (if you want RADIUS)
802.1X Server Port	1812 (if you want RADIUS)
802.1X Server Shared Secret	The password you configured in step 2 (if you want RADIUS)

Step 4 - Connect

Note

This is system specific - this screenshot is for a Linux distribution with KDE Plasma Workspaces 5, with the system language set to German.

../../_images/interface_wireless_radius_3.png

To connect to the network, set the security setting to “WPA/WPA2 Enterprise” and the authentication setting to “Protected EAP (PEAP)”. The inner authentication should be set to MSCHAPv2, and the username and password are the ones you set up in the RADIUS plugin.