Recently my home AP took a massive plunge when a cat knocked it over, and long story short, we just had a baby and my money is going towards what we need for the little man. At this point I decided to use a Rpi3 with Raspibian Jessie Distro. It is fully updated, expanded, timezone set and kernel updated. I have been hunting the internet and using quite a few different guides to attempt to get an Access Point setup to work. I am at a bit of a crossroads with my setup. The main thing I am trying to achieve that is a bit different than most guides that I find is that I want my pfSense DHCP server to work for my WiFi as well. The DHCP seems to work, and I can get info to my Wireless Devices, but thats where it ends. Here is what I have done... Firewall/Gateway/DHCP/DNS = 10.150.15.1 wlan0 = 10.150.15.2 eth0 = 10.150.15.3 1. Install the software Basic software sudo apt-get install dnsmasq hostapd 2. Configure interface wlan0 /etc/dhcpcd.conf interface wlan0 static ip_address=10.150.15.2/24 3. Configured Network Interfaces /etc/network/interfaces allow-hotplug wlan0 iface wlan0 inet static address 10.150.15.2 netmask 255.255.255.0 # wpa-conf /etc/wpa_supplicant/wpa_supplicant.conf 4. Configure hostapd /etc/hostapd/hostapd.conf interface=wlan0 driver=nl80211 ssid=ssid-name hw_mode=g channel=1 macaddr_acl=0 auth_algs=1 ignore_broadcast_ssid=0 wpa=2 wpa_key_mgmt=WPA-PSK wpa_passphrase=password rsn_pairwise=CCMP ieee80211n=1 wmm_enabled=1 ht_capab=[HT40][SHORT-GI-20][DISSS_CCK-40] 5. configure hostapd to find config file on boot /etc/default/hostapd DAEMON_CONF=”/etc/hostapd/hostapd.conf” 6. Configure dnsmasq (new file) /etc/dnsmasq.conf interface=wlan0 bind-interfaces server=10.150.15.1 domain-needed bogus-priv dhcp-relay=10.150.15.2,10.150.15.1 7. Setup ipv4 forwarding /etc/sysctl.conf net.ipv4.ip_forward=1 8. nat setup between eth0 and wlan0 iptables –t nat –A POSTROUTING –o eth0 –j MASQUERADE iptables –A FORWARD –i eth0 –o wlan0 –m state --state RELATED,ESTABLISHED –j ACCEPT iptables –A FORWARD -i wlan0 –o eth0 –j ACCEPT 9. Saved the iptables Saved with the following command sudo sh –c “iptables-save > /etc/iptables.ipv4.nat” 10. Made the iptables load on boot /etc/rc.local (before exit 0) iptables-restore < /etc/iptables.ipv4.nat My thoughts are that in step 10 i have seen many people load the iptables in different ways, however this DOES load them, so i dont think this is the issue. My hostapd file looks similar to many others on the net using a Rpi3, however i have seen people use wpa_pairwise=CCMP and even wpa_pairwise=TKIP However after doing some reading i can see TKIP is not safe, and in general the rsn_pairwise=CCMP is the better pick. My dnsmasq file is where i am mostly unsure of what to do. As stated previously everyone is making the AP their DHCP, but this is not ideal for me as i do run a local ESXi server, and i like the pfSense firewall managing the different network's DHCP/DNS services. Using the dnsmasq dhcp-relay feature seems to be the best choice. Though proper setup here is a little hazy to me as I have never really toyed with dnsmasq directly (though it is in pfsense running behind the gui). At this point I can see the WiFi SSID, I can connect, and i get a DHCP response with address, gateway, dns info, but I can not ping anything, nor do i get internet.