I'm trying to set up a NordVPN hotspot on my Raspberry Pi 3B+ so I can connect it to my smart tv and get rid of Netflix region restrictions.

I have everything set up properly but still dnsmasq DHCP is refusing to give any IP address to devices that try to connect through Wifi.

I have set up static ip address on wlan0 in /etc/dhcpd.conf:

interface wlan0
static ip_address=

here is how my /etc/dnsmasq.conf looks like:

dhcp-option=3, #Gateway

my /etc/hostapd/hostapd.conf looks like this:


and i have done my iptables accordingly:

iptables -t nat -A  POSTROUTING -o tun0 -j MASQUERADE
iptables -A FORWARD -i tun0 -o wlan0 -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -i wlan0 -o tun0 -j ACCEPT

and here is the output of iptables --list :

Chain INPUT (policy DROP)
target     prot opt source                  destination

Chain FORWARD (policy ACCEPT)
target     prot opt source                  destination
ACCEPT     all  --  anywhere                anywhere             state RELATED,ESTABLISHED
ACCEPT     all  --  anywhere                anywhere

Chain OUTPUT (policy DROP)
target     prot opt source                  destination

Now I connect to NordVPN using:

nordvpn connect UK

and after connection is established and I can see tun0 connected in ifconfig and confirm that the VPN is active with traceroute , I take my phone and attempt to connect to the WiFi hotspot that was just created but it is stuck on "Obtaining IP Address" and never succeeds. I have tried a Windows Laptop and my smart TV as well and both fail to obtain IP address.

Does anyone know what the issue here is? Any help would be really appreciated.

  • I don't understand ... why you use dhcpd and dnsmasq in same time for dhcp server ? sudo netstat -laputen |grep :67 what is the pid name of your dhcp server ?
    – Ephemeral
    Commented Sep 5, 2019 at 18:17
  • @Ephemeral I'm just following the NAT part of this guide on the raspberry pi website and changed the iptables to tun0 instead of eth0 and added the two extra iptables commands according to this for some reason after a reboot I could no longer even ping the rPi or SSH to it so I had to wipe and reflash Raspbian. but this has happened a lot of times before
    – Alen
    Commented Sep 5, 2019 at 18:18
  • Okay, I'll watch
    – Ephemeral
    Commented Sep 5, 2019 at 18:20
  • @Ephemeral Also one thing that I observed, If I use sudo openvpn /pathtoconfig/ to connect to a openvpn server using a config file this issue with dhcp doesn't exist. I can have a openvpn hotspot without a problem. But Netflix can detect openvpn and doesn't let me watch.so I need to be able to use the nordvpn linux app but when that is active as tun0, for some reason the hotspot refuses to issue IP addresses.
    – Alen
    Commented Sep 5, 2019 at 18:23
  • 2
    You mean dhcpcd and not dhcpd, isn't it? If you start from scratch you may consider to use built-in functionality without fiddling with dnsmasq, hostapd and dhcpcd. This could simplify things: Setting up a Raspberry Pi as an access point - the easy way.
    – Ingo
    Commented Sep 5, 2019 at 20:50

1 Answer 1


Your input and output chain has a policy to drop, and you have no rules to accept, so all incoming packets are dropped, as are out going. Something like this will completely open the firewall and allow NAT.
iptables -P INPUT ACCEPT
iptables -F INPUT
iptables -F OUTPUT
iptables -F FORWARD
iptables -F -t nat
iptables -F

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.