Andre Mohren's questions

im currently setting up my home network infrastructure. Because i have multiple usages and only a single server, i installed proxmox as host system and created a pfsense based VM to use as firewall. The ethernet card is forwarded into the firewall vm, so the setup works when using cable. The next goal was to add wifi to the setup. So i aquired an Asus PCE-AX3000. Sadly the underlying bsd does not support the card, so i created another VM using Ubuntu 19.10 and forwarded the wifi card to that vm. Firstly i want to mention that the card is properly found and loaded by the vm:

01:00.0 Network controller: Intel Corporation Device 2723 (rev 1a)
        Subsystem: Intel Corporation Device 0084
        Physical Slot: 0
        Flags: bus master, fast devsel, latency 0, IRQ 16
        Memory at c1800000 (64-bit, non-prefetchable) [size=16K]
        Capabilities: [c8] Power Management version 3
        Capabilities: [d0] MSI: Enable- Count=1/1 Maskable- 64bit+
        Capabilities: [40] Express Endpoint, MSI 00
        Capabilities: [80] MSI-X: Enable+ Count=16 Masked-
        Capabilities: [100] Advanced Error Reporting
        Capabilities: [14c] Latency Tolerance Reporting
        Kernel driver in use: iwlwifi
        Kernel modules: iwlwifi

The main idea is to simply bridge the wifi card with the virtual interface on the vm, which is "plugged" into another proxmox host-bridge, containing the wifi VM and the firewall VM, so i can basicaly whitelist devices in my firewall, as all trafic is handled by the firewall anyway, plus i have a dedicated virtual interface for managing whatever is connected via wifi.

That bridges also completely work. The wifi vm itself uses netplan, so i configured netplan like this:

# This file describes the network interfaces available on your system
# For more information, see netplan(5).
network:
  version: 2
  renderer: NetworkManager
  ethernets:
    ens18:
      dhcp4: yes
      dhcp6: yes
    ens19:
      dhcp4: yes
      dhcp6: yes
  wifis:
    wlp1s0:
      access-points:
        Eiveo:
          mode: ap
          password: ...
  bridges:
    br0:
      interfaces: [ens19, wlp1s0]
      dhcp4: yes
      dhcp6: yes

Theoretically everything should work, but while the wifi network is found on all devices (phones, tv, pcs, notebooks, ...) Not a single device is able to connect. On the vm i cant manage to find any proper log with some useful information whenever a client connects. What i can find however is this line upon doing a netplan generate and apply:

... wifi NetworkManager[2754]: <info>  [...] policy: auto-activating connection 'netplan-wlp1s0-Eiveo' (da5e14bf-7c9b-3545-942c-056eb2fd009b)
... wifi NetworkManager[2754]: <info>  [...] device (wlp1s0): Activation: starting connection 'netplan-wlp1s0-Eiveo' (da5e14bf-7c9b-3545-942c-056eb2fd009b)
... wifi NetworkManager[2754]: <info>  [...] device (wlp1s0): state change: disconnected -> prepare (reason 'none', sys-iface-state: 'managed')
... wifi NetworkManager[2754]: <info>  [...] device (wlp1s0): state change: prepare -> config (reason 'none', sys-iface-state: 'managed')
... wifi NetworkManager[2754]: <info>  [...] device (wlp1s0): Activation: (wifi) access point 'netplan-wlp1s0-Eiveo' has security, but secrets are required.
... wifi NetworkManager[2754]: <info>  [...] device (wlp1s0): state change: config -> need-auth (reason 'none', sys-iface-state: 'managed')
... wifi NetworkManager[2754]: <info>  [...] device (wlp1s0): state change: need-auth -> prepare (reason 'none', sys-iface-state: 'managed')
... wifi NetworkManager[2754]: <info>  [...] device (wlp1s0): state change: prepare -> config (reason 'none', sys-iface-state: 'managed')
... wifi NetworkManager[2754]: <info>  [...] device (wlp1s0): Activation: (wifi) connection 'netplan-wlp1s0-Eiveo' has security, and secrets exist.  No new secrets needed.
... wifi NetworkManager[2754]: <info>  [...] Config: added 'ssid' value 'Eiveo'
... wifi NetworkManager[2754]: <info>  [...] Config: added 'mode' value '2'
... wifi NetworkManager[2754]: <info>  [...] Config: added 'frequency' value '2412'
... wifi NetworkManager[2754]: <info>  [...] Config: added 'key_mgmt' value 'WPA-PSK WPA-PSK-SHA256 FT-PSK'
... wifi NetworkManager[2754]: <info>  [...] Config: added 'psk' value '<hidden>'
... wifi wpa_supplicant[1396]: Note: nl80211 driver interface is not designed to be used with ap_scan=2; this can result in connection failures
... wifi wpa_supplicant[1396]: Using interface wlp1s0 with hwaddr 50:eb:71:f9:28:fb and ssid "Eiveo"
... wifi wpa_supplicant[1396]: wlp1s0: interface state UNINITIALIZED->ENABLED
... wifi wpa_supplicant[1396]: wlp1s0: AP-ENABLED
... wifi wpa_supplicant[1396]: wlp1s0: CTRL-EVENT-CONNECTED - Connection to 50:eb:71:f9:28:fb completed [id=0 id_str=]
... wifi kernel: [ 2877.598828] IPv6: ADDRCONF(NETDEV_CHANGE): wlp1s0: link becomes ready
... wifi NetworkManager[2754]: <info>  [...] device (wlp1s0): supplicant interface state: ready -> completed
... wifi NetworkManager[2754]: <info>  [...] device (wlp1s0): Activation: (wifi) Stage 2 of 5 (Device Configure) successful. Started Wi-Fi Hotspot "Eiveo"
... wifi NetworkManager[2754]: <info>  [...] device (p2p-dev-wlp1s0): supplicant management interface state: ready -> completed
... wifi NetworkManager[2754]: <info>  [...] device (wlp1s0): state change: config -> ip-config (reason 'none', sys-iface-state: 'managed')
... wifi NetworkManager[2754]: <info>  [...] device (br0): attached bridge port wlp1s0
... wifi NetworkManager[2754]: <info>  [...] device (wlp1s0): Activation: connection 'netplan-wlp1s0-Eiveo' enslaved, continuing activation
... wifi NetworkManager[2754]: <info>  [...] device (br0): IPv4 config waiting until carrier is on
... wifi NetworkManager[2754]: <info>  [...] device (br0): IPv6 config waiting until carrier is on
... wifi NetworkManager[2754]: <info>  [...] device (wlp1s0): state change: ip-config -> ip-check (reason 'none', sys-iface-state: 'managed')

Also the key_mgmt value using wpa_cli -i wlp1s0 status seems pretty weird:

bssid=50:eb:71:f9:28:fb
freq=2412
ssid=Eiveo
id=0
mode=AP
pairwise_cipher=CCMP+TKIP
group_cipher=TKIP
key_mgmt=UNKNOWN
wpa_state=COMPLETED
p2p_device_address=50:eb:71:f9:28:fc
address=50:eb:71:f9:28:fb
uuid=2603753d-14b3-5c52-a2a5-6e84b168c25c

I have no idea whats cause the problem, nor how to debug that. As the card generally works, and the whole bridge setup is tested, and the wifi vm itself apears properly in the firewalls dhcp client list, i expect the problem to be specific to the way netplan configures the wifi setup, but as i have literaly no idea where the problem lies, im asking here if anyone might be able to help me out :) Side note: Buying a wifi AP and attaching it via cable is not the desired option!

Thank you very much for assisting me!

After spending hours and hours i cannot manage to understand btrfs enough to use it the way i want.

In the end my goal is simple: Having a clean fail-proof solution for os upgrades. So i've exactly 3 things i need to do: Creating snapshot, Rollback to a snapshot and discarding a snapshot (as the upgrade was successfull).

Creating system snapshots:

btrfs subvolume snapshot @ /btrfs/@-before-upgrade

At first this command should create a snapshot called "@-before-upgrade" which is my current "/". Everything which writes to disk afterwards will not be inside that snapshot. This gives me the first problem: What if a running process was writing to a file or a service has data in memory which has to be stored? Is there any way to create a snapshot which will be used as "@" - "/" after a reboot?

Discard Snapshot:

If an upgrade was successfull, the snapshot can be safely deleted. If im not mistaken the correct command should be this:

btrfs subvolume delete /btrfs/@-before-upgrade

Rollback to snapshot:

If an upgrade was unsuccessfull, i need to revert to the state when i made the snapshot. So in the end after managing the first part, it was simply like a reboot instead of a power loss. So i need to swap the snapshot names, then reboot, and then remove the broken one. Question about that: After swapping them, will changes still be written in the now called "@-broken" snapshot? Or will everything suddenly keep writing into the new/old "@"? If so, is there any way like in above question to apply it after a reboot?

mv /btrfs/@ /btrfs/@-broken
mv /btrfs/@-before-upgrade /btrfs/@
reboot
btrfs subvolume delete /btrfs/@-broken

Thanks in advance for all the help and feedback.