How to Set Up a Wireless Access Point in Kali Linux

Setting up a wireless access point in Kali Linux allows you to share your internet connection or create an isolated test network for security assessments. This process requires configuring the network interface, establishing a DHCP server for client management, and critically, setting up iptables NAT rules to ensure connected devices have actual internet access rather than just local connectivity.

Prerequisites and Interface Identification

Before configuring the access point, you must identify the correct wireless interface that supports Access Point (AP) mode. Most modern wireless cards support this via the mac80211 driver framework, but older or proprietary drivers may not. Use the iw list command to verify support. Look for the section labeled "Supported interface modes" and ensure * AP is listed. If it is missing, your hardware or driver combination cannot create a software-based AP. Next, install the necessary packages if they are not already present. You will need hostapd to manage the wireless access point authentication and association, and dnsmasq to handle DHCP and DNS services for clients connecting to your new network. Install these using:

sudo apt update
sudo apt install hostapd dnsmasq iptables

Ensure your wireless interface is down before making changes to its configuration. Identify your interface name (commonly wlan0 or similar) using ip link show. Bring it down with sudo ip link set wlan0 down.

Configuring Hostapd for the Access Point

The hostapd daemon controls the wireless access point behavior. You need to create a configuration file, typically located at /etc/hostapd/hostapd.conf. This file defines the SSID, channel, encryption method, and other parameters. Create the configuration file with the following content, adjusting the values to match your desired setup:

interface=wlan0
driver=nl80211
ssid=Kali-AP
hw_mode=g
channel=6
wmm_enabled=0
macaddr_acl=0
auth_algs=1
ignore_broadcast_ssid=0
wpa=2
wpa_passphrase=YourStrongPassword
wpa_key_mgmt=WPA-PSK
wpa_pairwise=TKIP
rsn_pairwise=CCMP

Key settings include ssid for the network name, hw_mode for the wireless standard (g for 2.4GHz), and channel for the specific frequency channel. The wpa_passphrase sets the pre-shared key for WPA2-PSK security, which is significantly more secure than WEP and should be the standard for any modern deployment. Avoid using WEP as it is cryptographically broken and trivial to crack. After saving the file, configure hostapd to use this configuration by editing /etc/default/hostapd and uncommenting the line:

DAEMON_CONF="/etc/hostapd/hostapd.conf"

Bring the interface back up:

sudo ip link set wlan0 up

Then start the service:

sudo systemctl enable hostapd
sudo systemctl start hostapd

If the service fails to start, check the logs with journalctl -u hostapd for errors related to interface availability or configuration syntax.

Setting Up DHCP with Dnsmasq

Clients connecting to your access point need IP addresses to communicate. dnsmasq provides both DHCP and DNS resolution. Create a configuration file at /etc/dnsmasq.conf with the following settings:

interface=wlan0
dhcp-range=192.168.1.50,192.168.1.150,12h
dhcp-option=3,192.168.1.1
dhcp-option=6,8.8.8.8
server=8.8.8.8

This configures dnsmasq to listen on wlan0, assign IPs from the range 192.168.1.50 to 192.168.1.150, and set the gateway (option 3) and DNS (option 6) servers. Note that the gateway IP 192.168.1.1 must be assigned to the wlan0 interface manually since there is no physical router. Assign the static IP to the interface:

sudo ip addr add 192.168.1.1/24 dev wlan0

Enable and start dnsmasq:

sudo systemctl enable dnsmasq
sudo systemctl start dnsmasq

Enabling Internet Sharing with Iptables NAT

A common failure point in this setup is that connected devices can ping each other and the gateway but cannot reach the internet. This happens because traffic leaving the wireless interface is not being masqueraded (NATed) to appear as if it comes from the host's main interface. You must configure iptables to perform Network Address Translation. Assuming your primary internet connection is on eth0 or wlan1, replace eth0 in the following commands with your actual upstream interface. First, enable IP forwarding in the kernel:

echo 1 | sudo tee /proc/sys/net/ipv4/ip_forward

To make this persistent across reboots, add net.ipv4.ip_forward=1 to /etc/sysctl.conf and run sudo sysctl -p. Next, apply the NAT rules:

sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
sudo iptables -A FORWARD -i eth0 -o wlan0 -m state --state RELATED,ESTABLISHED -j ACCEPT
sudo iptables -A FORWARD -i wlan0 -o eth0 -j ACCEPT

The first rule masquerades outgoing traffic from the AP subnet through the internet interface. The subsequent rules allow established connections and new outbound traffic from the AP to pass through. Without these rules, your access point is isolated and useless for general internet access. Save these rules so they persist after a reboot using iptables-persistent or by adding them to a startup script. For users experiencing broader networking issues in Kali, such as inability to resolve names or connect to external services, refer to guides on Kali Linux: Troubleshooting Temporary Failure in Name Resolution or Unable to Connect Kali Linux VM to Internet to diagnose upstream connectivity problems that might mimic AP configuration errors.

Frequently Asked Questions

Why can't my connected devices access the internet?

This is almost always due to missing iptables NAT rules. Ensure you have executed the MASQUERADE command for your upstream interface and that IP forwarding is enabled in the kernel. Verify connectivity by pinging an external IP like 8.8.8.8 from a client device.

How do I change the password of my access point?

Edit the /etc/hostapd/hostapd.conf file and modify the wpa_passphrase field. After saving the changes, restart the hostapd service using sudo systemctl restart hostapd. Clients will need to reconnect with the new credentials.

Can I use this setup for Wi-Fi penetration testing?

Yes, but you should switch the interface to monitor mode instead of AP mode for capturing packets. Use airmon-ng to put the card into monitor mode and airodump-ng to capture traffic. Do not use the AP setup described here for passive monitoring, as it actively manages associations.

What is the difference between WPA2 and WEP security?

WPA2 uses AES encryption and is currently considered secure for most personal use cases, whereas WEP uses RC4 and is vulnerable to rapid cracking attacks. Always prefer WPA2-PSK or WPA3 over WEP to protect your network from unauthorized access.

How do I stop the access point service?

You can stop the services by running sudo systemctl stop hostapd and sudo systemctl stop dnsmasq. To prevent them from starting automatically at boot, disable them with the disable flag instead of stop.