Raspberry Pi - Hotspot/Access Point dhcpcd method

There are many guides for creating a Raspberry Pi Access Point but from Raspbian 9 Stretch the network setup has changed, which means a lot of guides are out of date. So this guide is about setting up a Raspberry Pi Access Point for Raspbian 9 Stretch onwards. Works for Raspbian 8 Jessie and PiOS 10 Buster & PiOS Bullseye.

I have two other guides on how to set up an automatic Raspberry Pi Access Point, which connects to your home network when you are at home and generates a hotspot when you are out.

For the Autohotspot guide to setup an internet routed hotspot suitable for RPi4, RPi3, RPi2 & Rpi: Click Here
For the Autohotspot guide to setup a non internet routed hotspot suitable for RPi ZeroW and RPi Zero 2: Click Here

Easy Installer Script: the setup in this guide is available in an installer at Raspberry Pi AutoHotspot and Static Hotspot Installer Script

Aim:

• This guide will go through how to set up a permanent access point for both internet routed, for RPi's with ethernet ports, and non internet routed access point for Pi Zero/W & Pi Zero 2.

 Requirements:

This has been tested on Raspbian Jessie, Raspbian Stretch, PiOS Buster & PiOS Bullseye. To see which version you have enter the command lsb_release -a

• Raspberry Pi 4
• Raspberry Pi 3 or 3 B+
• Raspberry Pi 1 or 2 with a USB Wifi Dongle*,
• Raspberry Pi Zero W, Pi Zero 2 and Zero with a USB WiFi Dongle* (network/internet  Access Point not useable as it has no ethernet port.)

*some USB WiFi dongles don't work in adhoc mode or don't work with with the nl80211 driver used in this guide for RPi4, RPi 3, RPi3 B+ & Pi Zero W , Pi Zero 2 nbuilt wifi, so you may want to check this first before starting.

To see if your usb WiFi dongle can be used as an access point enter the command; iw list ,scroll to section "Supported interface modes:" and look for * AP

Note about Raspbian & PiOS - Bullseye, Buster and Stretch Network Device Names

From Raspbian Stretch there has been changes to how the network drivers are named, called Predictable Network Interface Names,  and may be different for the usual wlan0 and wlan1 for wifi and eth0 for ethernet connections. Though the official Foundation version of PiOS seems to be keeping to the old standard names, at least at the time of writing,  this may not always be the case. For this guide I will use wlan0 as the device that is used.  

To check the device name for your setup enter the commmand iw dev and take a note of the "Interface" name. For wifi it should start with wl , replace your device name with any reference to wlan0 in the article, scripts and config files.

Step 1:

To start with hostapd hotspot client and dnsmasq lightweight dns server need to be installed.

Open a Terminal session.

Update Raspbian/PiOS with the latest updates by entering the commands:

sudo apt update
sudo apt upgrade


 To install hostapd enter the command:

sudo apt install hostapd


enter Y when prompted.

To install dnsmasq enter the command:

sudo apt install dnsmasq


enter Y when prompted

The installers will have set up the programme so they run when the pi is started and activated them. While we set the hotspot we should stop them running. This is done with the following commands:

sudo systemctl stop hostapd
sudo systemctl stop dnsmasq

Now the hostspot configuration file can be setup. This contains the name of the WiFi signal you will need to connect to (SSID) and the security password.

To edit the configuration files I will be using the nano text editor but if you prefer an editor with an point and click interface then replace nano with mousepad in the following instructions.

Hostapd Configuration

Using a text editor edit the hostapd configuration file. This file won't exist at this stage so will be blank.

sudo nano /etc/hostapd/hostapd.conf

download file here:

interface=wlan0
driver=nl80211
ssid=RPiHotSpot
hw_mode=g
channel=6
wmm_enabled=0
macaddr_acl=0
auth_algs=1
ignore_broadcast_ssid=0
wpa=2
wpa_passphrase=1234567890
wpa_key_mgmt=WPA-PSK
rsn_pairwise=CCMP

• The interface will be wlan0
• The driver nl80211 works with the Raspberry Pi 4, 3, 3 B+  & Pi Zero W onboard WiFi but you will need to check that your usb wifi dongle is compatable and can use Access Point mode.

For more information on wifi dongles see elinux.org/RPi_USB_Wi-Fi_Adapters

• The SSID is the name of the WiFi signal broadcast from the RPi, which you will connect to with your Tablet or phones WiFi settings.
• Channel can be set between 1 and 13. If you are having trouble connection because of to many wifi signals in your area are using channel 6 then try another channel.
• Wpa_passphrase is the password you will need to enter when you first connect a device to your Raspberry Pi's hotspot. This should be at least 8 characters and a bit more difficult to guess than my example.

To save the config file press ctrl & o and to exit nano press Ctrl & x

A change in hostapd means the service will be masked, so hostapd won't start when you reboot. To Unmask the hostapd service enter:

• sudo systemctl unmask hostapd
• sudo systemctl enable hostapd

Once you have completed the rest of the setup and rebooted Hostapd will start and generate the hotspot settings.

(Note:  this bit for /etc/default/hostapd does not need to be changed for PiOS Buster or Bullseye. This is for the older OS's Stretch and Jessie)

Now the defaults file needs to be updated to point to where the config file is stored.
In terminal enter the command

sudo nano /etc/default/hostapd

Change:
#DAEMON_CONF=""
to
DAEMON_CONF="/etc/hostapd/hostapd.conf"

Check the DAEMON_OPTS="" is preceded by a #, so is #DAEMON_OPTS=""

And save.

DNSmasq configuration

Next we need to update the DNSmasq.conf file. There are two setups depending if you need internet access or not.

DNSmasq Config 1 - No Internet

Open the dnsmasq.conf file with

sudo nano /etc/dnsmasq.conf

Go to the bottom of the file and add the following lines (download here)

#RPiHotspot config - No Intenet
interface=wlan0
domain-needed
bogus-priv
dhcp-range=192.168.50.150,192.168.50.200,255.255.255.0,12h

and the save (ctl & o) and exit (ctrl & x)

DNSmasq Config 2 - Internet Routed

Open the dnsmasq.conf file with

sudo nano /etc/dnsmasq.conf

Go to the bottom of the file and add the following lines (download here)

#RPiHotspot config - Internet
interface=wlan0
bind-dynamic 
domain-needed
bogus-priv
dhcp-range=192.168.50.150,192.168.50.200,255.255.255.0,12h

and the save (ctl & o) and exit (ctrl & x)

Step 2:

Now that hostapd and dnsmasq are configured we now need to make some changes to the interfaces file, the dhcpcd.conf file, setup ip_forwarding.

Interfaces File

The interfaces file is not required and should be empty of any network config. Depending which version of Raspbian you have this file may still contain network config.

Enter

sudo nano /etc/network/interfaces

If your file shows more than the standard top 5 lines like this

# interfaces(5) file used by ifup(8) and ifdown(8)
# Please note that this file is written to be used with dhcpcd
# For static IP, consult /etc/dhcpcd.conf and 'man dhcpcd.conf'
# Include files from /etc/network/interfaces.d:
source-directory /etc/network/interfaces.d

then make a copy of your file and then remove any excess lines from the interfaces file.

To make a backup of your interfaces file first, use the command

sudo cp /etc/network/interfaces /etc/network/interfaces-backup

DHCPCD.conf

Next we need to update the dhcpcd.conf file. Open the file with

sudo nano /etc/dhcpcd.conf

then scroll to the bottom of the file and add the line (Download here)

interface wlan0
nohook wpa_supplicant
static ip_address=192.168.50.10/24
static routers=192.168.50.1

If you are setting up the Internet routed hotspot then also include

static domain_name_servers=8.8.8.8

now save (ctrl & o) and exit (ctrl & x)

The line 'nohooks wpa_supplicant' will stop the network wifi from starting if you have an entry in /etc/wpa_supplicant/wpa_supplicant.conf . If this is not done then network wifi will override the hotspot.

This next bit is only if you would like devices to have internet access. If not skip to "Testing the Access Point".

 ip forwarding setup

For the internet to be available when an Ethernet cable is attached, IP forwarding needs to be activated. To do this enter

sudo nano /etc/sysctl.conf

look for the line

# Uncomment the next line to enable packet forwarding for IPv4
#net.ipv4.ip_forward=1

and remove the # so it is

# Uncomment the next line to enable packet forwarding for IPv4
net.ipv4.ip_forward=1

now save (ctrl & o) and exit (ctrl & x)

NFtables & IPtables setup

Next the rules need to be added that will allow any device connected to the access point to be able to use the a network or internet connected to eth0. This is done with IP Table rules for older OS’s Buster, Stretch and Jessie. Bullseye onwards use Nftables.
These tables will need to be loaded every time the Raspberry Pi starts up.

NFtables - Bullseye

First create a nftables directory to hold the rule file. 

sudo mkdir /etc/nftables

Change to the new folder with 

cd /etc/nftables

then create a new file for the NFT rules called nft-stat-ap.nft and paste in the rules below. This is also available fro download here

sudo nano nft-stat-ap.nft

flush ruleset

table inet ap {
	chain routethrough {
		type nat hook postrouting priority filter; policy accept;
		oifname "eth0" masquerade
	}

	chain fward {
		type filter hook forward priority filter; policy accept;
		iifname "eth0" oifname "wlan0" ct state established,related accept
		iifname "wlan0" oifname "eth0" accept
	}
}

 now save (ctrl & o) and exit (ctrl & x)

This file needs to be updated to executable. Enter the command

sudo chmod +x /etc/nftables/nft-stat-ap.nft

next open nftables.conf and add the line below to the bottom of the file, so that the rules are loaded when the nftables service starts.

sudo nano /etc/nftables.conf

add

include "/etc/nftables/nft-stat-ap.nft"

 now save (ctrl & o) and exit (ctrl & x)

So that the rules are used everytime the Pi starts the nftables service should be enabled.

enter the command

sudo systemctl enable nftables

NFtables are now setup, continue with the "Testing the Access Point" section below

IPtables - Buster, Stretch, Jessie

First create the file for the ip table rules.

sudo nano /etc/iptables-hs

add the lines below or download from here

#!/bin/bash
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
iptables -A FORWARD -i eth0 -o wlan0 -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -i wlan0 -o eth0 -j ACCEPT

now save (ctrl & o) and exit (ctrl & x)

Update the permissions so it can be run with

sudo chmod +x /etc/iptables-hs

Now the service file can be created which will activate the ip tables each time the Raspberry Pi starts up

Create the following file

sudo nano /etc/systemd/system/hs-iptables.service

Then add the lines below of download from here

[Unit]
Description=Activate IPtables for Hotspot
After=network-pre.target
Before=network-online.target

[Service]
Type=simple
ExecStart=/etc/iptables-hs

[Install]
WantedBy=multi-user.target

now save (ctrl & o) and exit (ctrl & x)

To activate the service file, so it starts at every boot up, enter the command

sudo systemctl enable hs-iptables

Testing the Access Point

The access point setup is now complete. To test that the setup is ok reboot the RPi.

 Once the RPi is up and running the wifi icon near the clock should now be two arrows facing opposite directions  This means it is an access point. On a Tablet, phone or Laptop scan for wifi signals. You should see one for RPiHotSpot.

Select this as the wifi signal to connect to. The password is what you setup in the hostapd.conf file. From my example it is 1234567890

Local wifi signals in range on Android. You will see RPiHotSpot and not RPiHotN

For SSH and VNC the connection ip is 192.168.50.10 also if you have setup the RPi as a webserver use the same ip to see the webpage.

For ssh use ssh This email address is being protected from spambots. You need JavaScript enabled to view it.

For vnc use 192.168.50.10::5900

If you have setup the Internet routed configuration. Connect an ethernet cable to the Raspbery Pi and your router and wait a few seconds. The hotspot will now allow connected wifi devices to use the internet as well as the Raspberry Pi

 Once you are happy the setup is working ok then your done.

Script Removal

If you don't wish to continue using the Hotspot then the Raspberry Pi can be reverted back to a standard wifi setup with the following steps.

Stop the Hostapd and dnsmasq services with the commands

sudo systemctl disable dnsmasq

sudo systemctl disable hostapd

In the /etc/dhcpcd.conf file remove the lines added at the bottom of the file.

#Static Hotspot
nohook wpa_supplicant
interface wlan0
static ip_address=192.168.50.10/24
static routers=192.168.50.1
static domain_name_servers=8.8.8.8

If you had previous config in your interfaces file and made a backup you can restore your original interfaces file with the command

sudo mv /etc/network/interfaces-backup /etc/network/interfaces

If you didn't setup an internet routed access point then your done, after a reboot your RPi will not longer be an Access Point. For Internet routed Hotspots you also need to do the following;

Disable the IP Tables setup

Disable the hs-iptables service with the command

sudo systemctl disable hs-iptables

Then disable ip forwarding

sudo nano /etc/sysctl.conf

look for the entry

# Uncomment the next line to enable packet forwarding for IPv4
net.ipv4.ip_forward=1

and add a # as follows

# Uncomment the next line to enable packet forwarding for IPv4
# net.ipv4.ip_forward=1

Disable NF Tables setup

open nftables,conf  

sudo nano /etc/nftables.conf

and remove the line

include "/etc/nftables/nft-stat-ap.nft"

If you know other NFtable rules are being used then you that is it, otherwise disable the nftables service.

sudo systemctl disable nftables

Access Point removal is now complete

Now reboot and the Raspberry Pi will be back to the standard wifi setup.

 Trouble Shooting

• If you get no wifi connection or no hotspot and have this icon then it is most likley there is an error in one of the configuration files.
• If the RpiHotspot signal can't be seen by another device, Use the command sudo systemctl status hostapd to see if there is an error with Hostapd.
• If Hostapd has an error that it is Masked then try
  • sudo systemctl unmask hostapd
  • sudo systemctl enable hostapd
  • sudo systemctl start hostapd
• If you don't get an internet connection when an ethernet cable has been attached, with the Internet routed setup, then you can check the ip table rules have been activated with the command sudo iptables -S If you don't see any rules but just get
  

  -P INPUT ACCEPT
  -P FORWARD ACCEPT
  -P OUTPUT ACCEPT
  

  
  then make sure the service was enabled with the command sudo systemctl enable hs-iptables and the iptables file has the correct permissions with sudo chmod +x /etc/iptables-hs
• Check the NFtables rules are loaded with the command  sudo nft list ruleset
• You can connect to the hotspot via an Android Phone but you can't get a ssh connection. Some users have found this issue where Android uses their data connection rather than the wifi. Disabeling data has allowed them to use ssh.