Setup Ubuntu as a Wifi Access Point.md

Using nmcli to configure a hostspot in bridge mode

My objective is to share my ethernet connection over my wifi under Ubuntu 21.10 in bridge mode (so avoiding NAT and letting the devices connected over the wifi to obtain their IP from the same gateway as the host)

Identify the devices

First find your devices using ip a, in my case I will be bridging

WIFI=wlp4s0
ETHERNET=enp3s0
YOUR_PASSWORD=super_secret
YOUR_SSID="My Bridged Wifi"

Allowing nmcli (Network Manager) to manage devices

By default, most of my network devices could not be managed by nmcli, the following helped:

Globally Managed Devices

Edit /usr/lib/NetworkManager/conf.d/10-globally-managed-devices.conf and either add exceptions or allow all devices to be namaged like this:

[keyfile]
unmanaged-devices=none

Remove netplan configs

If the wifi or ethernet devices are configured by netplan, they will still not be available for nmcli. Look under /etc/netplan/ and any configs defining the settings of your device and remove them.

Note: If your ethernet was configured with netplan, you will want to reconfigure it with nmcli

Reload settings

type nmcli device and check that your devices (except lo) are not marked as unmanaged. You may need to run

systemctl reload NetworkManager

In my case, this was not enough, I had to fully restart

nmcli Useful commands

# list devices
nmcli device

# list wifi networks
nmcli device wifi list

# list connections
nmcli connection

# delete a connection
nmcli connection delete <name>

Create a bridge

Check for kernel bridge support

lsmod | grep bridge
modinfo bridge

Make sure your devices are managed

nmcli device

should list your ethernet and wifi device as managed.

Create the bridge

nmcli connection add con-name 'bridge-br0' ifname br0 type bridge ipv4.method auto ipv6.method disabled connection.autoconnect yes stp no

Add ethernet and wifi

# add ethernet
nmcli connection add con-name "bridge-slave-${ETHERNET}" ifname ${ETHERNET} type bridge-slave master 'bridge-br0' connection.autoconnect yes

#add wifi
nmcli connection add con-name "bridge-slave-${WIFI}" ifname ${WIFI} type wifi slave-type bridge master 'bridge-br0' \
  wifi.mode ap \
  wifi.ssid "${YOUR_SSID}" \
  wifi-sec.psk "${YOUR_PASSWORD}>" \
  wifi-sec.key-mgmt wpa-psk

Bring the bridge up

Normally, the three connections should be up automatically (Network Manager keeps try to bring them up in the background). If not, you can bring them up manually with

nmcli connection up bridge-slave-${WIFI}
nmcli connection up bridge-slave-${ETHERNET}
nmcli connection up bridge-br0

After that, nmcli device should list all your devices as connected

Setup the bridge IP with a static IP

With this setup, the IP is no longer assigned to the ethernet device, instead it is acquired by the bridge.

To see the IP that was assigned to the bridge:

ip addr show dev br0

To assign a static IP

nmcli con modify bridge-br0 ipv4.method manual ipv4.address "192.168.0.2/24" ipv4.gateway "192.168.0.1"  ipv4.dns 192.168.0.1

Changes will not be immediate on the device, but can be applied with

nmcli device reapply br0

Setup the Wifi to run on 5Ghz

By default, my wifi would be configured using 2.4Ghz. This can be changed like this:

nmcli connection modify bridge-slave-${WIFI} wifi.band a

When setting the mode to a (5Ghz) it is also important to set a channel. To find supported channels by your device, you can run

iw phy phy0 info | grep "MHz \[" | grep -v "no IR" | grep -v "disabled"

This will list all the channels supported by your device, excluding the ones limited to client mode (no IR) or disabled (because if your region).

Then restart the connection

nmcli connection down bridge-slave-${WIFI}
nmcli connection up bridge-slave-${WIFI}

Troubleshooting

Enable wpa_supplicant debug logs:

wpa_cli -i ${WIFI} log_level debug

Monitor for errors using journalctl

journalctl -f -u wpa_supplicant -u NetworkManager -u systemd-networkd

If you see "Hotspot network creation took too long" chances are that wpa_supplicant failed somewhere, possibly because the channel provided is not supported. Double check that iw reg get shows a valid region, and that etc/default/crda is also correctly configured