0 Turn a Linux Machine into a Wi-Fi Access Point with NetworkManager.md

Turn a Linux Machine into a Wi-Fi Access Point (AP) with NetworkManager

If you’re running a modern Linux distro like Debian 12 “Bookworm,” NetworkManager is the default way to manage networking. Below is a simple, copy-paste friendly guide to turn your device (e.g., a Raspberry Pi or small PC with a supported Wi-Fi adapter) into a wireless access point. We’ll cover WPA2, WPA3, and a mixed “transition” mode.

In the commands below, we assume you already created an AP connection profile named rpi-ap. Replace it with your own profile name if different.

---

Prerequisites

• NetworkManager is installed and managing your interfaces.
• Your Wi-Fi adapter supports AP (AP/Hotspot) mode.
• You have an existing AP profile (e.g., created with nm-connection-editor, nmtui, or nmcli).

---

A. When Using NetworkManager (default on Bookworm)

1) WPA2-PSK (AES/CCMP)

Use WPA2 when you need broad compatibility, especially for older devices.

# Assume the existing AP profile is named rpi-ap
sudo nmcli connection modify rpi-ap \
  wifi-sec.key-mgmt wpa-psk \
  wifi-sec.psk "StrongPass1234" \
  802-11-wireless-security.pmf 1 \
  802-11-wireless-security.pairwise ccmp
# pmf=1 means "optional" (recommended) — keeps WPA2 compatibility
sudo nmcli connection up rpi-ap

What this does

• wifi-sec.key-mgmt wpa-psk: enables WPA2-PSK.
• pmf 1: turns on Management Frame Protection (MFP/PMF) as optional, which keeps older WPA2 clients working.
• pairwise ccmp: forces AES/CCMP (avoid TKIP).

---

2) WPA3-Personal (SAE)

Choose WPA3 for stronger security (newer devices only).

sudo nmcli connection modify rpi-ap \
  wifi-sec.key-mgmt sae \
  wifi-sec.psk "StrongPass1234" \
  802-11-wireless-security.pmf 2 \
  802-11-wireless-security.pairwise ccmp
# pmf=2 means "required" — WPA3 mandates PMF
sudo nmcli connection up rpi-ap

What this does

• wifi-sec.key-mgmt sae: enables WPA3-Personal (SAE).
• pmf 2: required by WPA3.
• Still uses AES/CCMP.

---

3) WPA2/WPA3 Mixed (Transition Mode)

Run both simultaneously to ease migration: new devices use WPA3, old ones fall back to WPA2.

sudo nmcli connection modify rpi-ap \
  wifi-sec.key-mgmt "sae;wpa-psk" \
  wifi-sec.psk "StrongPass1234" \
  802-11-wireless-security.pmf 1 \
  802-11-wireless-security.pairwise ccmp
sudo nmcli connection up rpi-ap

Why this setting

• sae;wpa-psk: advertises both WPA3 and WPA2.
• pmf 1 (optional) maintains compatibility with older WPA2 clients while still offering WPA3 to capable devices.

---

Notes & Tips

• PMF (aka MFP, 802.11w)

  • WPA3: PMF required (pmf=2)
  • WPA2: PMF is optional; set pmf=1 for best compatibility.

• Passphrase: Use a strong passphrase without shell-special characters or quote it properly (as shown).

• Channels & Country Code: For stability and legal compliance, set your regulatory domain (e.g., sudo iw reg set JP) and choose a non-overlapping channel in your AP profile.

• Auto-start: NetworkManager will bring the AP up on boot if the profile is set to autoconnect (nmcli connection modify rpi-ap connection.autoconnect yes).

• Troubleshooting:

  • Check logs with journalctl -u NetworkManager or nmcli -p device wifi show.
  • Ensure no competing service (like hostapd managed separately) is fighting NetworkManager for control.

---

With these one-liners, you can quickly switch your Linux box between WPA2, WPA3, or a safe transition mode—no reboot required.