Introduction

This guide is for users who would like to create a Wi-Fi hotspot from their Qubes OS qube. This can be useful if you want to provide a Wi-Fi network tunnelling the traffic through a VPN or sys-whonix.

Basically, the hotspot runs in a qube, and the traffic will pass through the qube's netvm.

Requirements

You need a Wi-Fi device, either USB or integrated.

Setup

The guide uses non-minimal templates.

• Create a qube called sys-hotspot, choose Fedora or Debian, it is up to you:
• Add the service network-manager
• Make it Provides network
• Make it Disposable template
• Start the qube

Edit /rw/config/rc.local to the following script to it:

if [ "$(qubesdb-read /qubes-vm-persistence)" = "none" ]
then
    while true
    do
        WIFI_INTERFACE=$(iw dev | awk '/Interface/ { print $2 }')
        if [ -n "$WIFI_INTERFACE" ]
        then

            nmcli dev wifi hotspot ifname "$WIFI_INTERFACE" ssid kiQu6Quoh1 password "solene1234"
            nft add rule ip qubes input iif "$WIFI_INTERFACE" accept

            break
        fi
        sleep 5
    done

fi

• Stop the qube,

> ℹ️ This piece of shell waits indefinitely for a wifi interface to be connected, when it happens, it allows all incoming traffic on this interface and starts a Wi-Fi hotspot named "your_ssid_name_here" with the password "the_PSK_password". Adapt to your needs.

> ℹ️ For better security, this guide configures a named disposable qube to be the hotspot. You will never need to start sys-hotspot again except if you want to change the SSID or PSK.

USB Wi-Fi

If your Wi-Fi device is USB, follow this:

• Create a named disposable qube sys-hotspot-dvm, with the template sys-hotspot
• Start the qube
• Attach your WiFi USB device to the qube

Integrated Wi-Fi

> ⚠️ This is more for advanced users, as you will need to modify sys-net and to juggle between two "sys-net" depending if you connect to Ethernet or Wi-Fi

If your Wi-Fi device is integrated into the computer, it is slightly complicated and you will not be able to connect to Wi-Fi and create a hotspot at the same time.

You will need to remove the Wi-Fi device from sys-net devices:

• Open sys-net settings
• In "Devices" tab, remove the Wi-Fi device

You need a new qube to connect to Wi-Fi when you need to:

• Create a new qube sys-net-wifi:
• An AppVM if you want changes to be persistent, or a Named disposable based on default-dvm if you do not want to store information about Wi-Fi access points
• Make it "Provides network"
• When you want to switch between ethernet and Wi-Fi, toggle sys-firewall netvm between sys-net and sys-net-wifi

Now, you need to create the qube that will do the hotspot:

• Create a named disposable qube sys-hotspot-dvm, with the template sys-hotspot
• Open its settings
• Make it a "HVM" type qube (remove memory ballooning if any)
• Add the Wi-Fi device
• Start the qube

Extra

Random password at boot

You can easily modify the script to have a random SSID and/or random password every time the Wi-Fi starts. I recommend the program pwgen but some shell tricks using /dev/urandom could be used too.

In the network manager applet, you can display the Wi-Fi information that will display both the SSID and the password in cleartext.

USB devices issues

I tried with an old atheros device, I need to disconnect / reconnect it after attaching to a qube.