Software access point

A software access point, also called virtual router or virtual Wi-Fi, enables a computer to turn its wireless interface into a Wi-Fi access point. It saves the trouble of getting a separate wireless router.

Requirements

Wi-Fi device must support AP mode

You need a nl80211 compatible wireless device, which supports the AP operating mode. This can be verified by running the iw list command, under the Supported interface modes block there should be AP listed:

$ iw list

Wiphy phy1
...
	Supported interface modes:
		 * IBSS
		 * managed
		 * '''AP'''
		 * AP/VLAN
		 * WDS
		 * monitor
		 * mesh point
...

Wireless client and software AP with a single Wi-Fi device

Creating a software AP is independent from your own network connection (Ethernet, wireless, ...). Many wireless devices even support simultaneous operation both as AP and as wireless "client" at the same time. Using that capability you can create a software AP acting as a "wireless repeater" for an existing network, using a single wireless device. The capability is listed in the following section in the output of iw list:

The constraint means that your software AP must operate on the same channel as your Wi-Fi client connection; see the setting in hostapd.conf below.

If you want to use the capability/feature, perhaps because an Ethernet connection is not available, you need to create two separate virtual interfaces for using it. Virtual interfaces for a physical device can be created as follows: The virtual interfaces with unique MAC address are created for the network connection () itself and for the software AP/hostapd "wireless repeater":

# iw dev wlan0 interface add wlan0_sta type managed addr 12:34:56:78:ab:cd  
# iw dev wlan0 interface add wlan0_ap  type managed addr 12:34:56:78:ab:ce

Random MAC address can be generated using macchanger.

Configuration

Setting up an access point consists of two main parts:

1. Setting up the Wi-Fi link layer, so that wireless clients can associate to your computer's software access point and exchange IP packets with it.
2. Setting up the network configuration on your computer, so that it properly relays IP packets between its own internet connection and the wireless clients.

Wi-Fi link layer

The actual Wi-Fi link is established via the package, which has WPA2 support.

Adjust the options in hostapd configuration file if necessary. Especially, change the and the . See hostapd Linux documentation page for more information.

For automatically starting hostapd on boot, enable the hostapd.service.

If you are starting hostapd on boot, make sure the wireless network interface is brought up first, otherwise it will fail. To ensure your wireless interface is ready, edit the unit configuration file and state that it is bound to and should start after your network interface:

Also make sure that the interface is not managed by other network managers. If you are using NetworkManager, see NetworkManager#Ignore specific devices.

Note: If you have a card based on RTL8192CU chipset, install hostapd-rtl871xdrv^AUR and replace driver=nl80211 with driver=rtl871xdrv in the hostapd.conf file.

Network configuration

There are two basic ways for implementing this:

1. bridge: creates a network bridge on your computer, wireless clients will appear to access the same network interface and the same subnet that is used by your computer.
2. NAT: with IP forwarding/masquerading and DHCP service, wireless clients will use a dedicated subnet, data from/to that subnet is NAT-ted. This is similar to a normal Wi-Fi router which is connected to the internet.

The bridge approach is simpler, but it requires that any service that is needed by the wireless clients, in particular DHCP, is available on the computer's external interface. This means it will not work if the external modem which assigns IP addresses, supplies the same one to different clients.

The NAT approach is more versatile, as it clearly separates Wi-Fi clients from your computer and it is completely transparent to the outside world. It will work with any kind of network connection, and (if needed) traffic policies can be introduced using the usual iptables approach.

It is possible to combine these two approaches: for example having a bridge that contains both an ethernet device and the wireless device with a static ip, offering DHCP and setting NAT configured to relay the traffic to an additional network device connected to the WAN.

Bridge setup

You need to create a network bridge and add your network interface (e.g. ) to it. You should not add the wireless device (e.g. ) to the bridge; hostapd will add it on its own.

See Network bridge.

NAT setup

See Internet sharing#Configuration for configuration details.

In that article, the device connected to the LAN is . That device would be in this case your wireless device (e.g. ).

Tools

linux-wifi-hotspot

The package provides a script that can create either a bridged or a NATed access point for internet sharing. It combines hostapd, dnsmasq and iptables for the good functioning of the access point. Includes both command line and gui. The basic syntax to create a NATed virtual network is the following:

# create_ap wlan0 eth0 MyAccessPoint MyPassPhrase

Alternatively, the template configuration provided in can be adapted to ones need and the script run with:

# create_ap --config /etc/create_ap.conf

To use the GUI, run in terminal:

# wihotspot

Enable/start the to run the script at boot time with the configuration specified in .

For more information see linux-wifi-hotspot on GitHub.

RADIUS

See for instructions to run a FreeRADIUS server for WPA2 Enterprise.

Troubleshooting

WLAN is very slow

Frequent causes for a lower than expected throughput include

• An improper choice of operation mode with a hw_mode lower than the one supported can limit the router artificially. Check that a modern operating mode is selected.
• A crowded or otherwise noise afflicted can severely degrade performance especially in densely populated areas. Try changing to a different channel or even switch frequencies.
• The availability of too little entropy can lead to poor performance. Consider installing haveged.

NetworkManager is interfering

hostapd may not work, if the device is managed by NetworkManager. You can mask the device using MAC:

Or interface name:

/etc/NetworkManager/conf.d/unmanaged.conf

[keyfile]
unmanaged-devices=interface-name:''ifname''

Cannot start AP mode in 5 GHz band

Apparently with the special country code (global), all usable frequencies in the 5Ghz band will have the (no-initiating-radiation) flag set, which will prevent hostapd from using them. You will need to have installed and have your country code set to make frequencies allowed in your country available for hostapd.

Note that recent Intel devices have a Location-Aware Regulatory (LAR) feature, which ignores the userspace regulatory database and instead deduces the regulatory region by listening to other nearby access points. This means the devices will not transmit on any 5 GHz frequencies until they have first seen other access points on the 5 GHz frequency bands, preventing any 5 GHz transmission at all in many cases. Older kernels had an option to disable this which was removed in 2019 due to it causing the firmware to crash. Since this removal, Intel cards supporting LAR can no longer be used as access points in the 5 GHz band.

See also

• Hostapd : The Linux Way to create Virtual Wi-Fi Access Point
• tutorial and script for configuring a subnet with DHCP and DNS