Home Network --> wlan0 --> VPN --> wlan1 --> Hotspot

Raspbian Jessie with Pixel:

Using inbuilt Wifi adapter to connect to my home network, while external one as hostpot. No ethernet. I have tried for over a week setting up my rpi 3 model b to use a VPN over hostpot using hostapd and many dhcp configs in vain.

Word of wisdom: Not a novice or an expert

I have borrowed my steps from many many online articles but there is no updated version to work with new rpi 3 b. I am gonna provide them as a reference here.

What works: wlan0 connected to home network VPN on Pi, with a static IP assigned to wlan1 Hostapd, isc-dhcp Driver for wlan1 installed IP address, subnet assigned to client.

What's not: Hotspot made out of VPN on client side (cellphone)

My suspect: iptables or network interfaces or dhcpcd.conf (located at etc/dhcpcd.conf)

Strange scenario: If "# iface default inet dhcp" gets added to interfaces, isc-dhcp fails! Even with hashed out I get this issue. Once removed, all worked!

Ref: https://bit.ly/2g2NKfI

Configuration Used:

DHCPD: /etc/dhcp/dhcpd.conf:

subnet netmask {
    option broadcast-address;
    option routers;
    default-lease-time 600;
    max-lease-time 7200;
    option domain-name "local";
    option domain-name-servers,;

ISC-DHCP-Server: /etc/default/isc-dhcp-server:


Hostapd: /etc/hostapd/hostapd.conf: (custom version was used here)




Network Interface: /etc/network/interfaces:

auto lo
iface lo inet loopback

iface eth0 inet manual

allow-hotplug wlan0
iface wlan0 inet manual
    wpa-conf /etc/wpa_supplicant/wpa_supplicant.conf

#allow-hotplug wlan1
iface wlan1 inet manual
#   wpa-conf /etc/wpa_supplicant/wpa_supplicant.conf

up iptables-restore < /etc/iptables.nat.vpn.secure

DHCPCD: /etc/dhcpcd.conf:

interface wlan1

static ip_address=
static routers=
static domain_name_servers=

NAT: /etc/sysctl.conf:


sh -c "echo 1 > /proc/sys/net/ipv4/ip_forward"


iptables -A INPUT -i tun0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -i tun0 -j DROP
iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE

sh -c "iptables-save > /etc/iptables.nat.vpn.secure"

Rules that renders no effect:

iptables -A FORWARD -i tun0 -o wlan1 -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -i wlan1 -o tun0 -j ACCEPT


VPN works on Pi. Hotspot works. No internet on client side. Client, basically a phone, gets assigned correct IP with subnet mask. Can't browse the Internet.

What's causing this failure?

1 Answer 1


Shouldn't your MASQUERADE rule be applied on your RPI's physical interface, instead of tun0? You want traffic from your VPN clients to be nat-ed to your RPI's IP, so that your home's router can reply to such traffic, through your RPI.

iptables --table nat --append POSTROUTING --src [network for your tun0] --out-interface wlan1 --jump MASQUERADE
  • Let me thank you first for even getting on this! I tried your suggestion and although I am trying to achieve the same, still it fails somehow. Made an update about what I wish to implement. Meanwhile could you please take a look at the reference link to understand what I have done here.
    – sudonow
    Nov 19, 2016 at 22:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.