I have been hunting the internet and using quite a few different guides to attempt to get an Access Point setup to work.

I am at a bit of a crossroads with my setup.

The main thing I am trying to achieve that is a bit different than most guides that I find is that I want my pfSense DHCP server to work for my WiFi as well. The DHCP seems to work, and I can get info to my Wireless Devices, but thats where it ends. Here is what I have done...

0. Basic Info

Firewall/Gateway/DHCP/DNS =
wlan0 =
eth0 =

1. Install the software

Basic software

sudo apt-get install dnsmasq hostapd

2. Configure interface wlan0


interface wlan0
static ip_address=

3. Configured Network Interfaces


allow-hotplug wlan0
iface wlan0 inet static
#    wpa-conf /etc/wpa_supplicant/wpa_supplicant.conf

4. Configure hostapd



5. configure hostapd to find config file on boot



6. Configure dnsmasq (new file)



7. Setup ipv4 forwarding



8. nat setup

between eth0 and wlan0

iptables –t nat –A POSTROUTING –o eth0 –j MASQUERADE
iptables –A FORWARD –i eth0 –o wlan0 –m state --state RELATED,ESTABLISHED –j ACCEPT
iptables –A FORWARD -i wlan0 –o eth0 –j ACCEPT

9. Saved the iptables

Saved with the following command

sudo sh –c “iptables-save > /etc/iptables.ipv4.nat”

10. Made the iptables load on boot

/etc/rc.local (before exit 0)

iptables-restore < /etc/iptables.ipv4.nat


My thoughts are that in step 10 i have seen many people load the iptables in different ways, however this DOES load them, so i dont think this is the issue.

My hostapd file looks similar to many others on the net using a Rpi3, however i have seen people use wpa_pairwise=CCMP and even wpa_pairwise=TKIP However after doing some reading i can see TKIP is not safe, and in general the rsn_pairwise=CCMP is the better pick.

My dnsmasq file is where i am mostly unsure of what to do. As stated previously everyone is making the AP their DHCP, but this is not ideal for me as i do run a local ESXi server, and i like the pfSense firewall managing the different network's DHCP/DNS services. Using the dnsmasq dhcp-relay feature seems to be the best choice. Though proper setup here is a little hazy to me as I have never really toyed with dnsmasq directly (though it is in pfsense running behind the gui).

At this point I can see the WiFi SSID, I can connect, and i get a DHCP response with address, gateway, dns info, but I can not ping anything, nor do i get internet.


Upon executing the following command i get some info on the initialization of the hostapd config.

CMD: sudo /usr/sbin/hostapd /etc/hostapd/hostapd.conf

Configuration file: /etc/hostapd/hostapde.conf
Failed to create interface mon.wlan0: -95 (Operation not supported)
wlan0: Could not connect to kernel driver
Using interface wlan with hwaddr >MAC ADDRESS< and ssid "name"
wlan0: interface stat UNINITIALIZED->ENABLED
  • Can no one help??
    – Andreas
    Commented Aug 16, 2016 at 14:12
  • I feel this is a problem with packet forwarding. I have tried so many guides bit by bit and its just not working. Someone PLEASE save the day!!
    – Andreas
    Commented Aug 19, 2016 at 10:46
  • wlan0 = eth0 = You can not have two network interfaces on the same subnet and expect things to work (at least without having them bridged, but that doesn't appear the case here). Both interfaces must be on separate networks (subnets, prefixes whichever you prefer) in order to have packets route properly. That may not be the only one, but it's the most glaring.
    – stevieb
    Commented Sep 2, 2016 at 15:37
  • Aha! A voice of reason :) actually I put this project down for a bit because of lack of progress. But that actually makes a lot of sense. Ideally I think that with what I am wanting I would most likely want them bridged yes? I could see if the wlan0 had a different address that I would then need/want a separate DHCP server for the WiFi, but that is not what I want to achieve. I would like the pfSense DHCP server to be the one in use for my wifi. So I do just need a bridged interface. Or what do you think Stevieb?
    – Andreas
    Commented Sep 2, 2016 at 15:50
  • If you put both interfaces in separate networks, you can configure a DHCP Relay (research dhcrelay... I've never used DHCP relay on *nix, only Cisco/Juniper) to forward DHCP requests from one network to the DHCP server in the other, allowing you to have a single DHCP server for both networks. Both bridging and routing have their benefits/drawbacks. I personally would route, as that creates separation between the wired network and wireless, and makes firewall rules much more distinctive.
    – stevieb
    Commented Sep 2, 2016 at 15:54

2 Answers 2

Firewall/Gateway/DHCP/DNS =
wlan0 =
eth0 =

Unless you're bridging interfaces (which you don't appear to be), you must have each network interface within it's own network prefix (subnet), or else the device won't know how to route packets.

So if you change your wlan0 to instead of, that'll at least be a start.

You will need to add a route in the pfSense gateway so it knows how to get to the new wifi network (route to You'll also have to point the wifi clients to the new wifi IP on the Pi as their gateway (eg.

You'll then want to configure your Pi to be a DHCP relay (dhcrelay) to forward DHCP requests over to the DHCP server on the non-wifi network to provide the ability to have the server serve up addresses to both networks.

That will also require you to set up a new DHCP scope for this new wifi subnet as well.

I'm not versed in iptables, but the config does look reasonably sane at an unexperienced glance, but some rejigging may be necessary.

Your forwarding setup looks correct, so hopefully this'll be all you need.

You may consider ignoring the DHCP relaying until you at least get to the point you can route traffic using static IPs between the two networks (ie. wifi device behind the Pi can at least ping (successfully) the inside interface of the pfSense box).


I followed more or less the same steps as yours using the tutorial here.

My problem was at the nat setup step (IPv4 forwarding), you need to make sure that the forwarding interface (eth0 in your case) is working properly, meaning that it is connected to the internet, before writing the iptables statements to create the iptables.nat file. I also found out that I couldn't just modify the saved iptables.nat after it was created: the statements needed to be run first before

sudo sh –c “iptables-save > /etc/iptables.ipv4.nat”

Not the answer you're looking for? Browse other questions tagged or ask your own question.