I have a PC that acts as server/gateway/router for a LAN. And i'd like to add a third interface to act as wifi access point to it, such as that the LAN devices can reach the WIFI connected devices, and either of them being able to access the Internet trough the gateway.

I've already got LAN connected devices working perfectly accessing Internet trough the gateway and the services on the gateway (ssh, http etc.). But for some reason, the devices connecting to the WIFI AP can neither reach Internet or the gateway.

I suspect it might just be a simple detail in my configurations that i'm overlooking. (most likely in my IP addressing setup and/or in my shorewall masquerade setup ?..)


  • The Gateway can access The Internet/WAN.
  • The wired/LAN can access The Internet trough the Gateway
  • The wired/LAN can access the services running on the Gateway
  • The WIFI-connected devices however can not reach the Gateway, the LAN or Internet
    • they do apparently get authenticated correctly by hostapd
    • they do receive intended DHCP settings seemingly fine
      • But even ping (the gateway's ip) fails

Software stack on the gateway/router:

  • systemd-networkd (to set up the interfaces' and the ISP gateway connection)
  • shorewall (for firewall and router)
  • unbound (for caching/forwarding DNS server)
  • dhcpd(4) (for DHCP server)
  • hostapd (for setting up the wifi AP)

Physical interfaces on the gateway/router:

  • the WAN/Internet interface (dynamic adresses from ISP by DHCP):
## from 'ip address show'

4: enp0s20u1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether <REDACTED MAC> brd ff:ff:ff:ff:ff:ff
    inet <REDACTED IP> brd scope global dynamic noprefixroute enp0s20u1
       valid_lft 9497sec preferred_lft 7239sec
    inet6 <REDACTED IP> scope global dynamic noprefixroute 
       valid_lft 25472sec preferred_lft 25472sec
    inet6 <REDACTED IP> scope link 
       valid_lft forever preferred_lft forever
## /etc/systemd/network/enp0s20u1.network






  • the LAN/wired interface (static IP and "main" server interface):
## from 'ip address show'
2: ens1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether <REDACTED MAC> brd ff:ff:ff:ff:ff:ff
    altname enp2s0
    inet brd scope global ens1
       valid_lft forever preferred_lft forever
    inet6 <REDACTED IPV6 ADRESS> scope link 
       valid_lft forever preferred_lft forever
## /etc/systemd/network/ens1.network


  • the WIFI(AP) interface (as WPA(2)-PSK Access Point):
## from 'ip address show'
3: wlp0s20u2u1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether <REDACTED MAC> brd ff:ff:ff:ff:ff:ff
    inet brd scope global wlp0s20u2u1
       valid_lft forever preferred_lft forever
    inet6 <REDACTED IPV6 ADDRESS> scope link 
       valid_lft forever preferred_lft forever```
## /etc/systemd/network/wlp0s20u2u1.network


Shorewall configs:

## /etc/shorewall/interfaces
internet        NET_IF          dhcp,tcpflags,nosmurfs,routefilter,logmartians,sourceroute=0,physical=enp0s20u1
lokal           LOCAL_IF        dhcp,tcpflags,nosmurfs,routefilter,logmartians,physical=ens1
lokal           WIFI_IF         dhcp,tcpflags,nosmurfs,routefilter,logmartians,physical=wlp0s20u2u1
docker          docker0         bridge
## /etc/shorewall/zones
fw              firewall
internet        ipv4
lokal           ipv4
docker          ipv4
## /etc/shorewall/snat
MASQUERADE              NET_IF
MASQUERADE              NET_IF
## from /etc/shorewall/rules
Invalid(DROP)   internet        all             tcp

# allow 'lokal' to access dhcpd
ACCEPT         lokal            $FW     udp     67:68

#allow DNS
DNS(ACCEPT)     $FW             internet
DNS(ACCEPT)     lokal           $FW

# allow 'lokal' to ssh into to gateway
ACCEPT          lokal           $FW             tcp     2222

# ping stuff
Ping(ACCEPT)    lokal           $FW
Ping(DROP)      internet        $FW
ACCEPT          $FW             lokal           icmp
ACCEPT          $FW             internet        icmp

#just some http(/s) stuff
ACCEPT          internet        $FW             tcp     80,443
ACCEPT          lokal           $FW             tcp     8090,8443
ACCEPT          internet        $FW             tcp     8090,8443

DHCPD config:

## /etc/dhcpd.conf
subnet netmask
        option subnet-mask    ;
        option routers        ;
        option domain-name-servers;

subnet netmask

HOSTAPD config:

## /etc/hostapd/hostapd.conf

# "g" simply means 2.4GHz band
# the channel to use
# limit the frequencies used to those allowed in the country
# the country code
# 802.11n support
# QoS support, also required for full speed on 802.11n/ac/ax

# the name of the AP
# 1=wpa, 2=wep, 3=both
# WPA2 only
wpa_passphrase=<REDACTED PSK PASSWORD>

Some (possibly) relevant notes:

I'd be happy to provide any other potentially useful information upon request in comments.

  • 1
    By AP, do you mean an actual AP or hostapd? I have a working config of the latter I can look at. It also could be your firewall settings - I did mine with firewalld, and that 'simply' uses the same syntax as iptables, and bridged all my 'lan' interfaces, including the wifi ap
    – Journeyman Geek
    Jul 13, 2021 at 22:07
  • @JourneymanGeek A USB wifi adapter (the wlp0s20u2u1 device) is being used as accesspoint (by using hostapd)
    – DhP
    Jul 13, 2021 at 22:08
  • 1
    Your subnetting seems utterly wrong. isn't a valid subnet ID (rather it's a valid host in If you are not bridging wlp0s20u2u1 and ens1 together, you should use a separate subnet for the wifi network (e.g. and make dhcpd give out IP/route/so on for the two LAN appropriately / correspondingly.
    – Tom Yan
    Jul 14, 2021 at 8:23
  • 1
    With your current setting you'll probably have conflicting route and most likely all replies for (which includes host assigned with IP will be routed out of ens1.
    – Tom Yan
    Jul 14, 2021 at 8:27
  • 1
    I suppose it depends on whether you really need them to be in one broadcast domain (L2). If not you can push routes like via and via with DHCP to hosts in the two network respectively to allow them to communicate on (only) L3 (IP).
    – Tom Yan
    Jul 14, 2021 at 16:58


You must log in to answer this question.

Browse other questions tagged .