AP (Routed) using Systemd-Networkd

systemd-networkd is more than an DHCP client. It has a built-in DHCP server that can assign ip addresses to clients connected to the AP. For outgoing packets it has built-in Network Address Translation (NAT). Which replaces the client's ip address with the AP's ip address.

If the NetworkManager is your default network manager, then you need to disable it:

sudo systemctl disable --now NetworkManager

If the systemd-networkd package is not installed, you need to install it:

sudo apt install systemd-networkd
sudo systemctl enable -now systemd-networkd

If systemd-resolved package is not installed, install it:

sudo apt install systemd-resolved
sudo system enable --now systemd-resolved

The systemd-resolved daemon stores resolve configuration at /run/systemd/resolve/resolv.conf. Since many applications rely on finding that information at /etc/resolv.conf, it is common practice to create a symlink [1].

sudo ln -sf /run/systemd/resolve/resolv.conf /etc/resolv.conf

Reboot

sudo reboot now

References:

1. Gits - sepastian/debian_laptop_networking_setup.md
2. Linuzize - Ln Command in Linux (Create Symbolic Links)

DHCP Server

Assign the wireless interface an ip address and configure the built-in DHCP server.

In the /etc/networkd/network directory create a file with the extension ".network" and place the following in that file:

[Match]
Name=wlan0

[Network]
# Assign a static ip address
Address=192.168.4.1/24

#
MulticastDNS=yes

#
DNS=192.168.37.1

# use the built-in Masquerade
IPMasquerade=ipv4

# use the built-in DHCP server
DHCPServer=yes

[DHCPServer]
PoolOffset=100
PoolSize=154
EmitDNS=yes
DNS=192.168.37.1
        

The IPMasquerade=ipv4 statement, will enable packet forwarding and generate nft tables that will perform NAT.

The DHCPServer statements will assign ip addresses to AP clients.

If both interfaces are ethernet, you can stop here.

Radio and Authentication

All that is left to do is to set up the server's radio and client authentication. For this, there are two options:

1. Use wpa_supplicant
2. use hostapd

Option 1 - use wpa_supplicant

Wpa_supplicant can be used as both a server and a client.

To use wpa_supplicant to set up the wireless server and authenticate clients, in the directory /etc/systemd/network create a file wpa_supplicant-wlan0.conf, and place the following in it [4,5,6]:

country=US
ctrl_interface=DIR=/var/run/wpa_supplicant GROUP=netdev
update_config=1

network={
    # RADIO:

    # AP name 
    ssid="Tracker-1"

    # scanning mode
    mode=2

    # channel 6
    frequency=2437

    # AUTHENICATION: 
    #key_mgmt=NONE   # uncomment this for an open hotspot
    # delete next 3 lines if key_mgmt=NONE
    key_mgmt=WPA-PSK
    proto=RSN WPA
    psk="password"
}
        

The password is in plain text. Therefore, only allow root to read this file:

sudo chmod 600 /etc/wpa_supplicant/wpa_supplicant-wlan0.conf

Enable the service:

sudo systemctl disable --now wpa_supplicant.service
sudo systemctl enable -- now wpa_supplancant@wlan0.service

Reboot

sudo reboot

For troubleshooting, see reference [4] below.

Option 2 - use hostapd

The instructions are the same as hostapd above.

NAT tables

Systemd-networkd generated two nft tables. One for IPv4 and one for IPv6. They are more complicated than my simple NAT table.

To view the tables:

sudo nft list ruleset

table ip io.systemd.nat {
	set masq_saddr {
		type ipv4_addr
		flags interval
		elements = { 192.168.4.0/24 }
	}

	map map_port_ipport {
		type inet_proto . inet_service : ipv4_addr . inet_service
	}

	chain prerouting {
		type nat hook prerouting priority dstnat + 1; policy accept;
		fib daddr type local dnat ip to meta l4proto . th dport map @map_port_ipport
	}

	chain output {
		type nat hook output priority -99; policy accept;
		ip daddr != 127.0.0.0/8 oif "lo" dnat ip to meta l4proto . th dport map @map_port_ipport
	}

	chain postrouting {
		type nat hook postrouting priority srcnat + 1; policy accept;
		ip saddr @masq_saddr masquerade
	}
}
table ip6 io.systemd.nat {
	set masq_saddr {
		type ipv6_addr
		flags interval
	}

	map map_port_ipport {
		type inet_proto . inet_service : ipv6_addr . inet_service
	}

	chain prerouting {
		type nat hook prerouting priority dstnat + 1; policy accept;
		fib daddr type local dnat ip6 to meta l4proto . th dport map @map_port_ipport
	}

	chain output {
		type nat hook output priority -99; policy accept;
		ip6 daddr != ::1 oif "lo" dnat ip6 to meta l4proto . th dport map @map_port_ipport
	}

	chain postrouting {
		type nat hook postrouting priority srcnat + 1; policy accept;
		ip6 saddr @masq_saddr masquerade
	}
}
        
        

Summary

Systemd-networkd is a complete network manager. All of the parmeters are stored in two configuration files: /etc/systemd/network/*.network and /etc/wpa_supplicant/wpa_suplicant-wlan0.conf. Hence, there is no need for crontab to call anything at reboot.

Be aware that some older articles would lead you to believe that systemd-networkd is not a complete network manager. For example, the article in references [11] and [12] uses dnsmasq rather than the built-in DHCPServer, and to implement NAT, Firewalld is used. This article is well written, but conceptionaly it is very misleading.

Systemd-Networkd References:

1. systemd.network(5) 256- Linux manual page
2. Debian's systemd.network(5) before 256 — Linux manual page
3. Systemd Gains IP Forwarding, IP Masquerading & Basic Firewall Controls
4. Stack Exchange - Setting up a Raspberry Pi as an access point - the easy way
5. Arch Linux - wpa_supplicant - See Sectin 5.2.2
6. 100% systemd network configuration with Debian GNU/Linux
7. Stack Exchange - setup wireless router using systemd-networkd *.network files
8. Raspberry Pi networking the systemd way
9. Fedora Discussion - DHCPServer of systemd-networkd
10. Stack Exchange - Automatically Create Hotspot if no Network is Available
11. Fedora Magazine - Build a network router and firewall with Fedora 22 and systemd-networkd
12. Major Hayden - Build a network router and firewall with Fedora 22 and systemd-networkd

[connection]
id=profile_AP
uuid=cdaa8553-332e-4ab1-8318-97c79a1b4406
type=wifi
interface-name=wlan0
timestamp=1740158557

[wifi]
band=bg
mode=ap
ssid=Tracker-3

[wifi-security]
key-mgmt=wpa-psk
pairwise=ccmp;
proto=rsn;
psk=12345678

[ipv4]
address1=192.168.4.1/24
method=shared

[ipv6]
addr-gen-mode=default
method=ignore

[proxy]
         

table ip nm-shared-wlan0 {
	chain nat_postrouting {
		type nat hook postrouting priority srcnat; policy accept;
		ip saddr 192.168.4.0/24 ip daddr != 192.168.4.0/24 masquerade
	}

	chain filter_forward {
		type filter hook forward priority filter; policy accept;
		ip daddr 192.168.4.0/24 oifname "wlan0" ct state { established, related } accept
		ip saddr 192.168.4.0/24 iifname "wlan0" accept
		iifname "wlan0" oifname "wlan0" accept
		iifname "wlan0" reject
		oifname "wlan0" reject
	}
}
         

                                                 +- RPi -------+
                                     +---+ 10.10.0.2   |          +- Laptop ----+
                                     |   |     WLAN AP +-)))  (((-+ WLAN Client |
                                     |   |  Bridge     |          | 10.10.0.5   |
                                     |   +-------------+          +-------------+
                 +- Router ----+     |
                 | Firewall    |     |   +- PC#2 ------+
(Internet)---WAN-+ DHCP server +-LAN-+---+ 10.10.0.3   |
                 |   10.10.0.1 |     |   +-------------+
                 +-------------+     |
                                     |   +- PC#1 ------+
                                     +---+ 10.10.0.4   |
                                         +-------------+
        

© Copyright Dr. Ray Franco, PhD, PE | 2006-2025. All rights reserved.

---