Configuring 802.1x authentication on wired WAN interface by uci

Technical Support for Routers
1

Hello,
I am Hans and I have bought an GL-MT1300. I would like the MT1300 to authenticate at 802.1x protected wired network at my home. I managed to do that by configuring a config file for wpa_supplicant
/etc/wpa_supplicant/wpa_glinet.conf

   ctrl_interface=/var/run/wpa_supplicant
   ap_scan=0
   network={
   key_mgmt=WPA-EAP
   eap=PEAP
   anonymous_identity="hans.doe@example.de"
   identity="hans.doe@example.de"*
   password="t0p$ecr€t"
   ca_cert="/etc/ssl/certs/T-TeleSec_GlobalRoot_Class_2.crt"
   phase2="auth=MSCHAPV2"
   }

and then to run it by

   # wpa_supplicant -d -Dwired -ieth0.2 -c/etc/wpa_supplicant/wpa_glinet.conf

The router authenticates itself and gets access to the network. Now I would like to configure this by the UCI command line interface but don’t know much about it and need some help.

In the LUCI web interface of the MT1300 I did not find any support for this. Is that quite different at AR750 Creta or AR750 Slate?

Kind Regards
Hans

2

Maybe you can try firmware 4.1 beta for MT1300.

It uses Open source wifi driver so Luci should be similar as other products.

3

Alzhao, thank you for reply! I would like to express my questions more clearly.
If I create the configuration file for the as described and start it via SSH, then the authentication on the network works.

I am now interested in how I can do this with the uci command line interface . Unfortunately, I’m not very familiar with it. Maybe someone can help me with this?

The other question was whether this can also be configured via the Luci web interface. I installed the suggested beta version and found the switch between the gl.inet web interface and the original Luci interface. But I didn’t find anything about how to authenticate the router on WAN interface in either of the web interfaces. But I think I read in another thread that another user managed to configure this router via the web interface of the AR750 Slate in such a way that it authenticated itself on an 802.1x protected WLAN (“eduroam”).

Regards
Hans

4

Can you check if it is this interface?

Luci->network->wireless, then edit wifi AP interface, find Wireless security

image
image1103×1208 31.6 KB

5

Yes, it is there for “radio0” and “radio1”, but I think it is not what I am looking for.

I have got a switch with 802.1x security at all his access ports. The MT1300 is attached to one of the access ports of the switch with its WAN interface (eth0.2). So, to get access to the network, the MT1300 has to reply the 802.1x authentication. That runs as shown in first posting by starting the wpa_supplicant from secure shell or an init script at the router.
Now I would like to configure that by uci comand line interface or by luci web interface.
There is no need to attach the router to a wpa-enterprise protected network by wireless but by wire.
Best
Hans

6

The UI I attached is to set up EAP for wifi.

I understand you are connecting MT1300 to your network by Wire but for EAP I think it still need to set in wifi settings.

7

@alzhao, you can also encrypt traffic on wired network connections with 802.1x. That’s not only a feature on wifi networks.

I really doubt OpenWRT has any good tools to do WIRED-802.1x in uci or luci. It is a pretty rare use-case. 802.1x in wired networks is pretty rare in consumer world.

8

I see. Thanks for your explanation.