I am connecting a raspberry pi to help a friend of mine. The wifi network it needs to be on is on a hidden SSID that has no password for WEP or WPA (security is done through other means), and it needs to setup for a static ip address.

I can't have access to the router to make it static though DHCP configs, and the gui applications the pi comes with can't seem to handle hidden networks.

This is suppose to be a very lightweight install, so I rather have the setup done through the /etc/network/interface and /etc/wpa-supplicant/wpa-supplicant files if possible and not use any external network manager for it.

3 Answers 3


WARNING This may work (because dhcp call disables dhcpcd). This will only work reliably if dhcpcd is disabled.

I too had a tough time with hidden networks and getting my RPi to connect, so much so I wrote/compiled a [edit: removed dead links, will re-upload when hosting issues are resolved] for not just connecting but also abtaining a second internal IP for more controll over what services where listening on what addresses. The examples and comments of the previos answers are both ok however as you requested something with wpa_supplicant as well I figured I'd share.

  • The first above link leads to a self-signed https site where you can download full copies of any of the guides hosted; spicifficly it'll lead to a script I use to ensure remote access and other services get restarted when the RPi decides to stop reconizing the hidden access point that I use. I'll be including it within this post too in case self-signed warnings keep you from clicking.

  • The second link leads to where the guides are being backed-up/re-shared on a normal http web site; spicifficly it leads to the example of /etc/network/interfaces & /etc/wpa_supplicant/wpa_supplicant which will also be provided in this post in the second and third code blocks.

Script for ensuring your RPi reconnects to hidden network and updates a domain name host with external IP address just in case your RPi is connected to a dynamic ISP

# Modify variables that contain yourwebsiteURL, yourSubdomain, yourToken, and username@emailaddress if you've a working mail server, then scroll to bottom of this script for usage instructions.
## Variables
mkdir -p $savePath
echo "Save path : $savePath \n Logs will be saved there if enabled."
## Functions
## this function restarts network interface and updates DNS server if ping to your servers web page fails. Does nothing if ping sucseads.
UpdateDNSchecker (){
    ping -s0.1 -c2 $extURL
    if [ $? != 0 ]
        date | tee -a /$savePathg/ipdown.log
        echo "Restarted network services because - $extURL - not reachable." | tee -a $savePath/ipdown.log
        ifdown --force $netInterface
        ifup $netInterface
        sleep 5
        date | tee -a /$savePath/ipdown.log
        echo "Sending update to - $dnsServerURL - incase public IP changed" | tee -a $savePath/ipdown.log
        echo url=${updateDNSserverURL} | curl -k -o $savePath/duck.log -K -
        echo "Your DNS server returned..." | tee -a $savePath/ipdown.log
        cat $savePath/duck.log | tee -a $savePath/ipdown.log
#       # Above updates duckdns.org name servers.
#       # Bellow calls the fallowing defined functions.
#       # Disable unwanted options with comment mark
#       # This function is called at the very end of this script
## this function is called within UpdateDNSchecker above to restart ssh and other servers if ping failed 
RestartServices (){
    service ssh restart | tee -a $savePath/ipdown.log
    service xrdp restart | tee -a $savePath/ipdown.log
## this function is called within UpdateDNSchecker above to save internal ips, ports and other useful networking information to logs
roundOutlogs (){
    echo "The results of tracerout on $extURL are;" | tee -a $savePath/ipdown.log
    traceroute $extURL | tee -a $savePath/ipdown.log
    echo "The results of netstat -rn are;" | tee -a $savePath/ipdown.log
    netstat -rn | tee -a $savePath/ipdown.log
    echo "The results of netstat -nat are;" | tee -a $savePath/ipdown.log
    netstat -nat | tee -a $savePath/ipdown.log
    date | tee -a $savePath/ipdown.log
    echo "###    End of above log   ###" | tee -a $savePath/ipdown.log
## this function is called within UpdateDNSchecker above to send logs out to the sys-admins email address. 
EmailResults (){
## only enable if your server also has been setup for sending emails to external servers.
##  or only enable if emailing to a server within your NAT that has been setup to recive email.
#   echo "Server down and IP logs are in attached attachment." | mail -a $savePath/ipdown.log -s "Updated-IP-from-$extURL" $emailAddress > /dev/null
## end of functions now calling main function that will start this script


### End of script ###
## Usage instructions
##  # Copy this script to your /usr/local/sbin directory
##  cp /wherever/you/downloaded/DNSupdater /usr/local/sbin/DNSupdater
##  # Provide executable permissions to this script
##  chmod +x /usr/local/sbin/DNSupdater
##  # Edit your /etc/conetab file and add the following line to run this script every 5 minuets
##  */5 *   * * *   root    /usr/local/sbin/DNSupdater.sh 2>&1 > /dev/null

Contence of /etc/network/interfaces

auto lo

iface lo inet loopback
iface eth0 inet dhcp

allow-hotplug wlan0
iface wlan0 inet manual
wpa-roam /etc/wpa_supplicant/wpa_supplicant.conf
## ID strings
iface extnat1 inet static
    post-up ip addr add brd + dev wlan0
#   Above adds and bellow removes extra IP when interface on spicific network is available.
    pre-down ip addr del brd + dev wlan0

Contence of /etc/wpa_supplicant/wpa_supplicant

ctrl_interface=DIR=/var/run/wpa_supplicant GROUP=netdev

In case you want to add a password protected WiFi network that is also hidden here's the proper way of placing the first few lins into wpa_supplicant.conf file.

wpa_passphrase "Your NATs SSID" "The Password" >> /etc/wpa_supplicant/wpa_supplicant.conf

I read that the network that you're trying to connect to is using something other than password; MAC address filtering? If so then they should consider adding password protection as an another layer of security because even an Android phone these days is capible of spoofing it's MAC address and most now are also capible of permiscious scanning of networks that they're not currently connected to; some require a bit more setup than others but the it is also posible with another RPi or PC to also exploit a network that is only using MAC address filtering and hidden network as it's security methods... of cource a WiFi password can also be cracked or leaked too so it's more about culling the hurd of would be exploiters. This is also why adding the passphrase as it's encrypted form is also suggested so that it doesn't leek easily when reconnecting; unlike stock Android phones; but that is why I run more than one network now, keeping the leekers on thier own password ;-)

Hope this added with the other examples already posted by others helps you out in maintaing your connections.


Here is a quick solution. This is how my /etc/network/interfaces file looks when it connects to a hidden / key less wireless connection. I am using a home router and hence my sub net is : 192.168.1. and all the ips are as per this subnet. You can modify it to suit your network.

auto lo
iface lo inet loopback

auto eth0
allow-hotplug eth0
iface eth0 inet dhcp

auto wlan0
allow-hotplug wlan0
iface wlan0 inet static
    address          #static ip
    gateway            #network gateway
    netmask          #netmask
    network            #subnet
    broadcast        #broadcast ip
    wpa-ssid "wireless-ssid"       #wireless ssid
    wpa-ap-scan 2                  #for scanning hidden networks
    wpa-key-mgmt NONE              #for no-key

Hope it helps.

Also for detailed, wpa options, have a look at this link.


  • Desn't seem to be working, no signal is being sent out. Changing it to static to dhcp and removing the network configs stuff except for the finding the ssid does not give it an ip address. Jun 25, 2015 at 15:27
  • @needoriginalname You can have a look at that link I attached. There are more options like wpa-protocol and etc. This one works fine for me. Jun 25, 2015 at 16:14
  • I found out the problem, for some reason the wpa_suppilcant did not understand ap_scan, and I instead used scan_ssid = 1. Don't know why that worked when many examples I saw said to use ap_scan=2, may be a version difference. Don't know. Jun 25, 2015 at 16:28
  • @needoriginalname As per that link (and my experience), if ssid is not being broadcasted (ie, wifi is hidden), you should use ap_scan=2. May be your wifi is not hidden or something. Jun 25, 2015 at 16:32

This works for me :

auto wlan0
allow-hotplug wlan0
iface wlan0 inet static
    address  #your static ip address here
    netmask #if you don't want subnets use this
    gateway   #ip address of router-gateway here
    wpa-scan-ssid 1
    wpa-ap-scan 1
    wpa-key-mgmt WPA-PSK
    wpa-proto RSN WPA
    wpa-pairwise CCMP TKIP
    wpa-group CCMP TKIP
    wpa-ssid <"your ssid here">
    wpa-psk <psk value here>

wlan0 interface is set to connect to a hidden network directly for getting your own psk value which you can see the long thing at wpa-psk type:

wpa_passphrase "<Your Wifi SSID>" "<Your Wifi PASSWORD>"

Then you'll get psk value and put it in there.

Protocols may vary between your router and mine so you might need to substitute them with yours

Link of the guide: http://www.dafinga.net/2013/01/how-to-setup-raspberry-pi-with-hidden.html

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.