Sometimes you need a Linux machine — a Raspberry Pi, an old laptop, a dedicated router appliance — to broadcast its own Wi-Fi network rather than just connecting to one. This is called running the machine as a wireless access point (AP). This article explains, from first principles, how access points work, what software makes this possible on Linux, and walks through a complete, practical setup using hostapd and dnsmasq.
What Is a Wireless Access Point?
An access point is a device that creates and broadcasts a Wi-Fi network (an SSID), allowing client devices to connect to it, much like a home router does. On Linux, this role is fulfilled primarily by hostapd (HostAP Daemon), which turns a compatible wireless network interface into an AP, working with the kernel’s mac80211 wireless subsystem.
flowchart TD
A[hostapd] -->|Broadcasts SSID, Handles Auth| B[Wireless Interface in AP Mode]
B --> C[Client Devices Connect]
C --> D[dnsmasq - DHCP + DNS]
D --> E[Clients Get IP Addresses]
B --> F[Optional: Bridge/NAT to Internet-Facing Interface]Requirements
- A wireless network adapter that supports AP mode (not all adapters do — check with
iw list) hostapd— handles the actual Wi-Fi broadcasting and client authenticationdnsmasq— provides DHCP and optionally DNS for connected clients- (Optional) NAT/routing configuration if you want to share an existing internet connection with AP clients
Step 1: Check AP Mode Support
iw list | grep -A 10 "Supported interface modes"
Look for AP in the list of supported modes. If it’s not listed, your specific wireless adapter/driver combination cannot act as an access point.
Step 2: Install Required Software
sudo apt install hostapd dnsmasq
Step 3: Assign a Static IP to the Wireless Interface
sudo nano /etc/dhcpcd.conf
Add (for interface wlan0):
interface wlan0
static ip_address=192.168.4.1/24
nohook wpa_supplicant
Restart:
sudo systemctl restart dhcpcd
Step 4: Configure hostapd
sudo nano /etc/hostapd/hostapd.conf
interface=wlan0
driver=nl80211
ssid=MyLinuxAP
hw_mode=g
channel=7
wmm_enabled=0
macaddr_acl=0
auth_algs=1
ignore_broadcast_ssid=0
wpa=2
wpa_passphrase=SecurePassphrase123
wpa_key_mgmt=WPA-PSK
wpa_pairwise=TKIP
rsn_pairwise=CCMP
Point the system to this configuration file:
sudo nano /etc/default/hostapd
DAEMON_CONF="/etc/hostapd/hostapd.conf"
Step 5: Configure dnsmasq for DHCP
Back up the default config first:
sudo mv /etc/dnsmasq.conf /etc/dnsmasq.conf.orig
sudo nano /etc/dnsmasq.conf
interface=wlan0
dhcp-range=192.168.4.2,192.168.4.20,255.255.255.0,24h
This hands out IP addresses from .2 to .20 on the 192.168.4.0/24 subnet, with a 24-hour lease time.
Step 6: Enable IP Forwarding (If Sharing Internet Access)
sudo nano /etc/sysctl.conf
Uncomment or add:
net.ipv4.ip_forward=1
Apply immediately:
sudo sysctl -p
Step 7: Configure NAT (If Sharing an Existing Internet Connection via eth0)
sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
sudo iptables -A FORWARD -i eth0 -o wlan0 -m state --state RELATED,ESTABLISHED -j ACCEPT
sudo iptables -A FORWARD -i wlan0 -o eth0 -j ACCEPT
Save these rules so they persist across reboots:
sudo apt install iptables-persistent
sudo netfilter-persistent save
Step 8: Start Everything
sudo systemctl unmask hostapd
sudo systemctl enable --now hostapd
sudo systemctl enable --now dnsmasq
Step 9: Verify
sudo systemctl status hostapd
sudo systemctl status dnsmasqFrom another device, search for Wi-Fi networks named MyLinuxAP and attempt to connect using the configured passphrase.
Comparison Table: AP Mode vs. Client Mode
| Aspect | Client Mode | AP Mode |
|---|---|---|
| Role | Connects to an existing network | Creates and broadcasts a new network |
| Software | wpa_supplicant, NetworkManager | hostapd |
| IP assignment | Received via DHCP from the network | Handed out to clients via dnsmasq |
| Typical device | Laptop, phone | Router, Raspberry Pi acting as a hotspot |
Real-World Use Case: A Portable Wi-Fi Hotspot for IoT Device Setup
Many IoT/embedded product setups use a Raspberry Pi or similar device configured exactly as above to create a temporary local network, allowing a smartphone app to connect directly to the device for initial configuration (Wi-Fi credentials, account linking) before the device connects to the customer’s actual home network.
Real-World Use Case: Extending Coverage in a Warehouse
An old laptop with a compatible wireless card can be repurposed as a bridge access point, extending Wi-Fi coverage to a warehouse floor by connecting to the main network over Ethernet (eth0) and rebroadcasting Wi-Fi via wlan0 using the exact NAT/bridging steps above.
Best Practices
- Always use WPA2 (or WPA3 if supported) rather than open or WEP networks for any AP you configure — see our dedicated WEP article for why WEP must never be used today.
- Choose a non-overlapping Wi-Fi channel if other networks are nearby, to minimize interference:
sudo iw dev wlan0 scan | grep -E "SSID|freq"<br>- Set a reasonable DHCP lease time and range sized appropriately for expected client count.
- Restrict AP access with MAC filtering only as a supplementary measure, not a primary security control — MAC addresses can be spoofed.
- Keep
hostapdanddnsmasqupdated, since both handle untrusted network input and are worth keeping patched. - Test failover behavior — what happens to connected clients if the AP process crashes? Configure
systemdto restart it automatically:
[Service]
Restart=on-failureTroubleshooting
Problem: hostapd fails to start — “Could not configure driver mode”
The wireless adapter or driver doesn’t support AP mode, or another process (like wpa_supplicant or NetworkManager) is still controlling the interface:
sudo systemctl unmask hostapd
sudo systemctl enable --now hostapd
sudo systemctl enable --now dnsmasqProblem: SSID broadcasts but clients can’t connect
Double-check the passphrase and encryption settings match what the client expects, and confirm wpa_key_mgmt and wpa_pairwise settings are supported by your client devices.
Problem: Clients connect but get no IP address
Check dnsmasq status and logs:
sudo systemctl status dnsmasq
sudo journalctl -u dnsmasq -n 50Problem: Clients connect and get an IP, but have no internet access
Verify IP forwarding is enabled and NAT rules are correctly applied:
sysctl net.ipv4.ip_forward
sudo iptables -t nat -L -vProblem: AP works but range is very poor
Some USB Wi-Fi adapters have weak transmit power in AP mode compared to dedicated router hardware — this may be a hardware limitation rather than a configuration issue. Consider a dedicated AP-capable adapter for serious deployments.
Conclusion
Turning a Linux machine into a wireless access point is a powerful, flexible capability, whether for IoT device setup, extending network coverage, or building custom networking appliances. By combining hostapd (for broadcasting and authenticating the Wi-Fi network) with dnsmasq (for DHCP/DNS) and standard Linux IP forwarding/NAT, you can build a fully functional access point from commodity hardware — as long as your wireless adapter supports AP mode in the first place.
