networkmanager and hostapd - wireless managed as wired

[Mithnar Menengrothello <mithnae posteo net>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi,

I'm trying to build a gateway/AP with two SSID managed by hostapd
without completely disabling NetworkManager. Base is CentOS7

My current setup looks like this and works.

+----------------+--------+---------------------+--------------------+
|                | enp5s6 - public IP by DHCP   |                    |
|                |                              |                    |
|                | managed by NM                |                    |
|                |                              |                    |
|                |                              |                    |
|                +-----^----------------^-------+                    |
|                      |                |                            |
|              +--MASQ-+                +----MASQ-----+              |
|              |                                      |              |
+------+-------+--------------+     +-----+-----------+--------------+
|| br0 - 192.168.1.0/24       +<-+  | br1 - 192.168.50.0/24         ||
|| created by network         | XXX | created by network            ||
|| managed by NM,             |  +->+ managed by NM                 ||
||                            |     |                               ||
|-------------------+-- ------+--------------------------------------|
|| enp7s0           | wlp6s0        | wlp6s0.1                      ||
|| joined to br0    |               |                               ||
|| by network       |               | created and managed by hostapd||
||                  |               | joined to br1 on creation     ||
||                  |               +--------------------------------|
||                  | managed by hostapd                            ||
||                  | joined to br0 by hostapd                      ||
+-------------------+-- ---------------------------------------------+

 - br0 is interal network comprised of wired enp7s0 and wireless
wlp6s0 (wireless managed by WPA2 Enterpise),
 - br1 is public guest wifi network with WPA2 Consumer. There is no
routing between the two.
 - Both are MASQeraded to external interface (enp5s6).
 - Firewall and masquerading is managed by firewalld.

All config is kept in /etc/sysconfig/ifcfg-* files, so during bootup
networking could be assembled by old networking initscript (it is not
disabled).

I'd like to let NetworkManager manage all interfaces, unfotunately as
for now it does not allow me to manage only III layer and up without
touching II Iayer of wifi interface (or I was not able to find
appropriate setting). Thus I had to create br1 to separate IP
configuration (managed by NM) and let  hostapd manage AP functionality
on virtual wlp6s0.1. This seem to be unnecessary, but I could not make
it work any other way.

My questions:

1. Is is it possible to make NetworkManager manage a wifi interface
just as an ordinary wired ethernet (no fooling around wireless
settings)? Wired interfaces can be with or without 802.1X so here
situation potentially can be no different.

2. Is it possible to let NM take over management of virtual wireless
interface (here wlp6s0.1) once it is created?
Now when the interfece is defined as NM-managed, "hotplug" to "yes"
and "type" is set to "wifi", network manager does not react to its
creation by hostapd and whet I try to bring the connection manually,
NM complains it canot find a device to manage.  Should it be possible
I could get rid of br1.
- -- 
Mith
Elen sila lumenn omentielvo
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (GNU/Linux)

iQGcBAEBAgAGBQJcZa4eAAoJEHsdvut2jC9BX80L/03+JsFCdtk3VCDABFOrsZiy
IJRzwYx7bAHoabXYWQSCBjq6f2VFIyj9aXg+IJ10Oo+db4DUX+qV5HbHK8uAmT1c
ZzA9hQgh75blrD1rFnsnHwlklCnNPJ8fWphVHEoJuCW9fO+WPyMVngmbBSG7cFHO
OcxsmdUnojB+wHbZ4i4pFB70uTejqoXx/DlopV7cWfO8WI/H98tWJqamhyuWZi3g
N7NgooNYcHXeSP1q/39o6HVYI3UFUcgHNUw6AFUdNXYzXmbdZz/FM5GZAbWmpDZj
KFz8GlUArvKLBpdOcvFdnepzYDN4qQ2QGyCkKnhNQPp5CvFDxbQO6kpdDc+Xq+NH
wYj6hVSwG5gafKn0HD8pDtUpyCEeCT16FU3P8BJ/e3nT1498bkoikFUspXdln+OG
n8NcUVCKOHFGkNHF1uejPXQCFUd+xgY4xjF9meWKgQUrhvkQVQM/lhVdVu4bskn9
TfiIGqofPqCt1rTngx51N9DS8aJRYFwOmuTaYXnywg==
=k5Dc
-----END PGP SIGNATURE-----