DEV Community

vast cow
vast cow

Posted on

Configuring hostapd on a MacBookPro14,2 with Ubuntu 24.04

This is a somewhat specialized use case, but this article documents how to use a MacBook Pro as a Linux router and Wi-Fi access point.

In this setup, I installed Ubuntu 24.04 on a MacBookPro14,2 (2017, 13-inch) and configured its built-in Broadcom wireless adapter as an access point using hostapd.

This article focuses specifically on configuring hostapd. It does not cover bridge configuration such as creating br0 or assigning IP addresses.

Environment

  • MacBookPro14,2
  • Ubuntu 24.04 LTS
  • hostapd
  • Wireless interface: wlp2s0
  • Wired interface: enx68da73adde3c
  • bridge=br0

hostapd uses the nl80211 driver. On modern Linux systems, nl80211 is typically specified when using mac80211/cfg80211-based drivers. (Linux Wireless Documentation)

hostapd.conf

The following configuration proved to be stable in the end.

interface=wlp2s0
bridge=br0
driver=nl80211

ctrl_interface=/run/hostapd
ctrl_interface_group=0

ssid=YOUR_SSID
ignore_broadcast_ssid=1

auth_algs=1

country_code=JP
ieee80211d=1

hw_mode=a
channel=36

wmm_enabled=1

ieee80211n=1
ieee80211ac=1

# Enabling these prevented the AP from starting in this environment
# ht_capab=[HT40+][SHORT-GI-20][SHORT-GI-40]
# vht_oper_chwidth=1
# vht_oper_centr_freq_seg0_idx=42

wpa=2
wpa_key_mgmt=WPA-PSK SAE
rsn_pairwise=CCMP

wpa_passphrase=YOUR_PASSWORD

ieee80211w=1
sae_require_mfp=1
Enter fullscreen mode Exit fullscreen mode

Configuration Details

bridge 

bridge=br0
Enter fullscreen mode Exit fullscreen mode

This places wireless clients on the same Layer 2 network segment as the wired LAN.

Since clients can obtain DHCP leases directly from the existing LAN, there is no need to run a DHCP server on the hostapd side. The Linux Wireless hostapd documentation also shows examples of using bridge= in bridged configurations. (Linux Wireless Documentation)

Fixed 5 GHz Operation 

hw_mode=a
channel=36
Enter fullscreen mode Exit fullscreen mode

This configures the access point to operate on the 5 GHz band.

In this setup, channel 36 in the W52 band was chosen to avoid DFS requirements.

Japan Regulatory Domain 

country_code=JP
ieee80211d=1
Enter fullscreen mode Exit fullscreen mode

Be sure to set country_code.

Without it, the available channels may be restricted.

WPA2/WPA3 Transition Mode 

wpa=2
wpa_key_mgmt=WPA-PSK SAE
Enter fullscreen mode Exit fullscreen mode

This configuration accepts both:

  • WPA2-Personal
  • WPA3-Personal (SAE)

Newer devices connect using WPA3, while older devices fall back to WPA2. (Git TI)

AES Only 

rsn_pairwise=CCMP
Enter fullscreen mode Exit fullscreen mode

Only AES (CCMP) is allowed. TKIP is disabled.

PMF 

ieee80211w=1
sae_require_mfp=1
Enter fullscreen mode Exit fullscreen mode

Protected Management Frames (PMF) are:

  • Optional for WPA2
  • Mandatory for WPA3

This configuration preserves WPA2 compatibility while satisfying WPA3 requirements. (Git TI)

Hide the SSID 

ignore_broadcast_ssid=1
Enter fullscreen mode Exit fullscreen mode

This prevents the SSID from being included in beacon frames.

However, there are several drawbacks:

  • It provides little to no real security benefit.
  • Clients must be configured manually.
  • Some devices may experience reduced connectivity.

Starting hostapd

To start hostapd with verbose debugging enabled:

sudo hostapd -dd /etc/hostapd/hostapd.conf
Enter fullscreen mode Exit fullscreen mode

When startup succeeds, you should see:

wlp2s0: AP-ENABLED
Enter fullscreen mode Exit fullscreen mode

The -d and -dd options enable increasingly detailed debug output. (Ubuntu Manpages)

Why 40 MHz / 80 MHz Wouldn't Work

Initially, I tried the following configuration:

ht_capab=[HT40+][SHORT-GI-20][SHORT-GI-40]

ieee80211ac=1
vht_oper_chwidth=1
vht_oper_centr_freq_seg0_idx=42
Enter fullscreen mode Exit fullscreen mode

However, hostapd failed to start with:

Could not set channel for kernel driver
Enter fullscreen mode Exit fullscreen mode

The log also contained:

80/80+80 MHz: no second channel offset
Enter fullscreen mode Exit fullscreen mode

iw list Reports HT40/VHT Support

The output of iw list included:

Band 2

HT20/HT40

VHT Capabilities
Enter fullscreen mode Exit fullscreen mode

At first glance, this suggests that 40 MHz operation and 802.11ac AP mode should be supported.

In practice, however, enabling:

ht_capab=[HT40+]
Enter fullscreen mode Exit fullscreen mode

prevented the access point from starting.

Removing HT40 Solved the Problem

The final configuration kept only:

ieee80211n=1
ieee80211ac=1
Enter fullscreen mode Exit fullscreen mode

and removed:

# ht_capab=[HT40+]
Enter fullscreen mode Exit fullscreen mode

With that change, hostapd started successfully.

In other words, this environment supports:

  • AP mode
  • 5 GHz
  • WPA2/WPA3
  • 802.11ac enabled

without issue, but

HT40 and VHT80 channel configurations were not available due to driver or firmware limitations.

The Linux Wireless documentation also notes that 80 MHz operation requires an appropriate combination of HT40+ and VHT channel settings, and that channel configuration can fail depending on driver capabilities or the regulatory database. (Linux Wireless Documentation)

Final Configuration

The final setup consists of:

  • 5 GHz operation
  • Channel 36
  • 20 MHz channel width
  • WPA2/WPA3 transition mode
  • AES (CCMP) only
  • PMF enabled
  • Bridged networking
  • Hidden SSID

Although throughput is lower than with 40 MHz or 80 MHz channels, this configuration proved to be stable and practical on a MacBookPro14,2 running Ubuntu 24.04, where reliability was the priority.

Top comments (0)