Introduction

This guide is for users who would like to create a Wi-Fi hotspot from their Qubes OS qube. This can be useful if you want to provide a Wi-Fi network tunnelling the traffic through a VPN or sys-whonix.

Basically, the hotspot runs in a qube, and the traffic will pass through the qube's netvm.

Requirements

You need a Wi-Fi device, either USB or integrated. If you connect to the Internet / Network with Wi-Fi, you need a second Wi-Fi device.

Setup

The guide uses non-minimal templates.

• Create a qube called sys-hotspot, choose Fedora or Debian, it is up to you:
• Add the service network-manager
• Make it Provides network
• Make it Disposable template
• Start the qube

Edit /rw/config/rc.local to add the following script to it:

if [ "$(qubesdb-read /qubes-vm-persistence)" = "none" ]
then
    while true
    do
        WIFI_INTERFACE=$(iw dev | awk '/Interface/ { print $2 }')
        if [ -n "$WIFI_INTERFACE" ]
        then
            # the device may require a few seconds to initialize after being attached
            sleep 4

            # configure the access point
            # pick the SSID you want
            # define the password you want
            nmcli dev wifi hotspot ifname "$WIFI_INTERFACE" ssid "your_ssid_name_here" password "the_PSK_password"

            # allow incoming DHCP traffic so clients can have an IP
            nft add rule ip qubes custom-input iifname "$WIFI_INTERFACE" meta l4proto udp udp dport 67 accept
            nft add rule ip qubes custom-input iifname "$WIFI_INTERFACE" meta l4proto tcp tcp dport 53 accept
            nft add rule ip qubes custom-input iifname "$WIFI_INTERFACE" meta l4proto udp udp dport 53 accept


            # handle DNS requests to Qubes OS DNS, you can still catch them later from a VPN qube anyway
            nft flush chain ip qubes dnat-dns
            nft add rule ip qubes dnat-dns iifname "$WIFI_INTERFACE" ip daddr 10.42.0.1 udp dport 53 dnat to 10.139.1.1
            nft add rule ip qubes dnat-dns iifname "$WIFI_INTERFACE" ip daddr 10.42.0.1 tcp dport 53 dnat to 10.139.1.1
            break
        fi
        sleep 5
    done
fi

• Stop the qube,

> ℹ️ This piece of shell waits indefinitely for a wifi interface to be connected, when it happens, it allows all incoming traffic on this interface and starts a Wi-Fi hotspot named "your_ssid_name_here" with the password "the_PSK_password". Adapt to your needs.

> ℹ️ For better security, this guide configures a named disposable qube to be the hotspot. You will never need to start sys-hotspot again except if you want to change the SSID or PSK.

USB Wi-Fi

If your Wi-Fi device is USB, follow this:

• Create a named disposable qube sys-hotspot-dvm, with the template sys-hotspot
• Start the qube
• Attach your WiFi USB device to the qube

Integrated Wi-Fi

> ⚠️ This is more for advanced users, as you will need to modify sys-net and to juggle between two "sys-net" depending if you connect to Ethernet or Wi-Fi

If your Wi-Fi device is integrated into the computer, it is slightly complicated and you will not be able to connect to Wi-Fi and create a hotspot at the same time.

You will need to remove the Wi-Fi device from sys-net devices:

• Open sys-net settings
• In "Devices" tab, remove the Wi-Fi device

You need a new qube to connect to Wi-Fi when you need to:

• Create a new qube sys-net-wifi:
• An AppVM if you want changes to be persistent, or a Named disposable based on default-dvm if you do not want to store information about Wi-Fi access points
• Make it "Provides network"
• When you want to switch between ethernet and Wi-Fi, toggle sys-firewall netvm between sys-net and sys-net-wifi

Now, you need to create the qube that will do the hotspot:

• Create a named disposable qube sys-hotspot-dvm, with the template sys-hotspot
• Open its settings
• Make it a "HVM" type qube (remove memory ballooning if any)
• Add the Wi-Fi device
• Start the qube

Extra

Use PFSense or OPNsense

It is possible to use PFSense or OPNsense as the system in the qube providing Wi-Fi, this allows you to administrate it using the Web user interface through a client of the Wi-Fi with some fancy features. This might require some work to bootstrap the configuration from the command line version.

Random password at boot

You can easily modify the script to have a random SSID and/or random password every time the Wi-Fi starts. I recommend the program pwgen but some pure shell snippet like $(tr -dc 'a-zA-Z0-9_@' </dev/urandom | head -c 16) could be used too.

In the network manager applet, you can display the Wi-Fi information that will display both the SSID and the password in cleartext.

USB devices issues

I tried with an old atheros device, I need to disconnect / reconnect it after attaching to a qube.