How to create a second Wifi?

[rusagent]

Hey,

i would like to set up 2 Hotspots. I have a Raspberry PI 4b. It has an integrated wifi adapter and i also have a second usb wifi adapter.
I'd like to have the wlan0 go over VPN and the second wlan1 go directly over the network without VPN.

Is that possible and if yes how?

Any help is very appreciated!

[billz]

It's possible with a manual configuration. Create two hostapd configuration files, eg. /etc/hostapd/wlan0.conf and /etc/hostapd/wlan1.conf. You will also need to add wlan1 configurations for dnsmasq and dhcpcd (be sure to restart the services).

Run hostapd interactively with both configs (debug switch -dd is optional):

sudo hostapd -dd /etc/hostapd/wlan0.conf /etc/hostapd/wlan1.conf

Connect clients to each AP and monitor the output. You could drop a custom systemd service file in /etc/systemd/system and use this in place of the default hostapd.service with your multiple configs.

[rusagent]

Hell yeah! Thanks for the hints! The config won't be overridden?

[billz]

RaspAP only manipulates /etc/hostapd/hostapd.conf so your custom hostapd configs won't be touched. The 2.6-beta release will let you manage the dhcp and dnsmasq configs from the UI, while also preserving any manual changes.

[rusagent]

So i tried but i kinda fail.

This is my hostapd config in /etc/hostapd/wlan0.conf

driver=nl80211
ctrl_interface=/var/run/hostapd
ctrl_interface_group=0
auth_algs=1
wpa_key_mgmt=WPA-PSK
beacon_int=100
ssid=UnsafeSpot
channel=6
hw_mode=g
ieee80211n=1
wmm_enabled=1
wpa_passphrase=blabla
interface=wlan0
wpa=2
wpa_pairwise=TKIP CCMP
country_code=US
ignore_broadcast_ssid=0

this for wlan1

driver=nl80211
ctrl_interface=/var/run/hostapd
ctrl_interface_group=0
auth_algs=1
wpa_key_mgmt=WPA-PSK
beacon_int=100
ssid=SafeSpot
channel=6
hw_mode=g
ieee80211n=1
wmm_enabled=1
wpa_passphrase=blabla
interface=wlan1
wpa=2
wpa_pairwise=TKIP CCMP
country_code=US
ignore_broadcast_ssid=0

Then this the config for /etc/dnsmasq.d/090_wlan0.conf

interface=wlan0
except-interface=wlan1
dhcp-range=10.4.141.50,10.4.141.255,255.255.255.0,12h

This one for wlan1

interface=wlan1
except-interface=wlan0
dhcp-range=10.3.141.50,10.3.141.255,255.255.255.0,12h

And this is the config for dhcpcd

# RaspAP default configuration
hostname
clientid
persistent
option rapid_commit
option domain_name_servers, domain_name, domain_search, host_name
option classless_static_routes
option ntp_servers
require dhcp_server_identifier
slaac private
nohook lookup-hostname

# RaspAP wlan0 configuration
interface wlan0
static ip_address=10.4.141.1/24
static routers=10.4.141.1
static domain_name_server=103.86.96.100 103.86.99.100

# RaspAP wlan1 configuration
interface wlan1
static ip_address=10.3.141.1/24
static routers=10.3.141.1
static domain_name_server=103.86.96.100 103.86.99.100

And this is a script that runs on startup via crontab

#!/bin/bash

sleep 30

sudo nordvpn c
sudo iptables -P INPUT ACCEPT
sudo iptables -P OUTPUT ACCEPT
sudo iptables -t nat -A POSTROUTING -o nordlynx -j MASQUERADE
sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

sudo iptables -A FORWARD -i nordlynx -o wlan1 -m state --state RELATED,ESTABLISHED -j ACCEPT
sudo iptables -A FORWARD -i wlan1 -o nordlynx -j ACCEPT

sudo iptables -A FORWARD -i eth0 -o wlan0 -m state --state RELATED,ESTABLISHED -j ACCEPT
sudo iptables -A FORWARD -i wlan0 -o eth0 -j ACCEPT

When i comment out the

sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
sudo iptables -A FORWARD -i eth0 -o wlan0 -m state --state RELATED,ESTABLISHED -j ACCEPT
sudo iptables -A FORWARD -i wlan0 -o eth0 -j ACCEPT

i get internet on wlan0 but not on wlan1 and that is also going over nordvpn. Any idea how to fix this? On wlan1 i don't get any ip on my computer...

ifconfig output:

eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.2.137  netmask 255.255.255.0  broadcast 192.168.2.255
        ether dc:a6:32:fd:e6:f7  txqueuelen 1000  (Ethernet)
        RX packets 1558  bytes 198655 (193.9 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 448  bytes 65238 (63.7 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        loop  txqueuelen 1000  (Lokale Schleife)
        RX packets 4  bytes 444 (444.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 4  bytes 444 (444.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

nordlynx: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST>  mtu 1420
        inet 10.5.0.2  netmask 255.255.0.0  destination 10.5.0.2
        unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  txqueuelen 500  (UNSPEC)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 6820721  bytes 4732731288 (4.4 GiB)
        TX errors 0  dropped 699 overruns 0  carrier 0  collisions 0

wlan0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 10.4.141.1  netmask 255.255.255.0  broadcast 10.4.141.255
        ether dc:a6:32:fd:e6:f8  txqueuelen 1000  (Ethernet)
        RX packets 2528  bytes 290332 (283.5 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 533  bytes 122890 (120.0 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

wlan1: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 10.3.141.1  netmask 255.255.255.0  broadcast 10.3.141.255
        ether 1c:bf:ce:ed:24:8d  txqueuelen 1000  (Ethernet)
        RX packets 1372  bytes 123872 (120.9 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 161  bytes 26689 (26.0 KiB)
        TX errors 0  dropped 35 overruns 0  carrier 0  collisions 0

[Gotcha007]

I'm not an expert but is the problem coming from the fact that both Wlan0 and Wlan1 have the same static ip?

[SalvadorSTM]

Any reason for using NordLynx? Apart from your interfaces IPs being the same.
I thought according to NordVPN they only supported TCP/UDP on OpenVPN.

https://support.nordvpn.com/General-info/1047408082/What-is-OpenVPN.htm
"With NordVPN, you can connect via OpenVPN both over TCP and UDP."

Also you shouldnt run multiple broadcasts on the same wifi channel. This will cause interference.
channel=6