Softcloud Wiki

RaspAP Documentation Pages

Sun, 08 Nov 2026 14:23:29 +0100

Overview

Sun, 08 Nov 2026 14:23:29 +0100

Simple AP setup & WiFi management for Debian-based devices

--- About ---

RaspAP is feature-rich wireless router software that just works on many popular Debian-based devices, including the Raspberry Pi. Our popular Quick installer creates a known-good default configuration in minutes on all current Raspberry Pis with onboard wireless.

--- Quick start ---

Start with a clean install of the latest release of Raspberry Pi OS Lite. Both the 32- and 64-bit release versions are supported. The Raspberry Pi OS Desktop distro is currently unsupported.

Tip

Be sure to use an official power supply with your device. Power supply requirements differ by Raspberry Pi model. Inadequate voltage is the source of many WiFi issues.

Update RPi OS to its latest version, including the kernel and firmware, followed by a reboot:

Code TEXT :

sudo apt-get update
sudo apt-get full-upgrade
sudo reboot

Set the WiFi country in raspi-config's Localisation Options:

sudo raspi-config

.

Important

Failure to perform this step will prevent the RPi from enabling wireless operation. When this happens, you will see the warning

Wi-Fi is currently blocked by rfkill

in the console.

Install RaspAP from your device's shell prompt:

Code BASH :

curl -sL https://install.raspap.com | bash

The Quick installer will complete the steps in the manual installation for you.

After the reboot at the end of the installation the wireless AP network will be configured as follows:

IP address: 10.3.141.1
Username: admin
Password: secret
DHCP range: 10.3.141.50 to 10.3.141.254
SSID:

raspi-webgui

Password: ChangeMe

Your AP's basic settings and many advanced options are now ready to be modified by RaspAP.

Tip

If this is not a clean install or you are configuring a device with a non-standard integration it's strongly recommended to follow the manual installation instructions.

--- Get Insiders ---

RaspAP is free software, but powered by your support. If you find RaspAP useful for your personal or commercial projects, become a sponsor and get access to exclusive features in the Insiders Edition.

--- Compatible operating systems ---

RaspAP was originally made for Raspbian, but now also installs on the following Debian-based distros.

Distribution	Release	Architecture	Support
Raspberry Pi OS	(64-bit) Lite Bookworm	ARM	Official
Raspberry Pi OS	(32-bit) Lite Bookworm	ARM	Official
Raspberry Pi OS	(64-bit) Lite Bullseye	ARM	Official
Raspberry Pi OS	(32-bit) Lite Bullseye	ARM	Official
Armbian	23.05 (Suni)	ARM	Official
Debian	Bookworm	ARM / x86_64	Beta
Ubuntu	Server 23.04 (Lunar)	ARM / x86_64	Beta

Please note that "supported" is not a guarantee. If you are able to improve support for your preferred distro, we encourage you to actively contribute to the project.

--- Get involved ---

We welcome all users of RaspAP to contribute to the project. This can take the form of issue reports, discussions, or pull requests. Developers can get started by following these steps:

Fork the project in your account and create a new branch:
```
your-great-feature
```
.
Open an issue in the repository describing the feature contribution you'd like to make.
Commit changes in your feature branch.
Open a pull request and reference the initial issue in the pull request message.

Find out more about our coding style guidelines and recommended tools.

--- Discussions ---

Questions or comments about the Quick start? Join the discussion here.

Ad blocking

Sun, 08 Nov 2026 14:23:29 +0100

RaspAP has introduced a new DNS based filter to stop ads, trackers, malware and other undesirable hosts in their tracks.

In the best of times, ads are usually just annoying. When access to online services served by our AP is hampered by ads, malware and trackers, the best tool in our arsenal is DNS blacklisting. RaspAP already uses

dnsmasq

to manage both DHCP and DNS, so we have the foundation for a highly effective ad blocking facility.

--- Quick installer ---

To install ad blocking with DNS blacklists, simply respond with Y or press Enter when prompted by the installer:

Code TEXT :

Install ad blocking and enable list management? [Y/n]

The installer will download the blocklists, configure RaspAP to use them and enable the Ad blocking management page.

Ad blocking is enabled and active for clients connected to your AP. You may update the blocklists or disable ad blocking with the management page. These actions are described below.

--- Manual installation ---

Ad blocking may also be installed manually. Refer to the detailed installation steps.

--- Blocklist sources ---

Blocklists are sourced from multiple, continuously updated open source projects. These are divided into two groups: hosts and domain blocklists. By default, RaspAP's ad block facility uses StevenBlack's hosts as the primary hosts blocklist. This repository is a hosts file aggregator that consolidates several reputable hosts files and merges them into a unified, optimized hosts file with duplicates removed.

Alternatively, users may choose from a number of host blocklist sources maintained by the badmojr/1Hosts GitHub project. These lists are compiled daily into Mini, Lite, Pro and Xtra versions depending on specific user needs. Refer to the GitHub project for an explanation of these different blocklists.

In addition to blocking hosts, domain blocking gives us the ability to use wildcards with

dnsmasq

to block an entire domain (for example,

baddomain.org

) with a single rule. This includes all known and unknown subdomains, such as

*.baddomain.org

. Domain blocklists are provided by the OISD project. Similar to hosts lists, these are continuously updated and curated into several lists: Small, Big and NSFW. Refer to the OISD project for an explanation of these lists.

--- Updating lists ---

Each of the hosts and domains blocklists are updated daily, so it's a good practice to refresh them periodically. You can do this from the Ad Blocking management page in RaspAP. Simply select the list from the dropdown and choose Update now.

Next to the update button, a gear icon will appear to indicate that the selected list is being downloaded. Thereafter, a timestamp after each list will indicate when it was last updated.

Note To apply the latest blocklists, be sure to Restart Ad Blocking.

---- Automatic updates ----

Alternatively, you may wish to automate the process of keeping the ad block source lists up-to-date. A method to achieve this is described in this FAQ.

--- Custom blocklist ---

In addition to the notracking blocklists, you may create your own host blocklist by adding entries on the Custom blocklist tab. Define custom hosts to be blocked by entering an IPv4 or IPv6 address followed by any whitespace (spaces or tabs) and the host name. An IPv4 example would take the form

0.0.0.0 badhost.com

. Choose Save settings and Restart Ad Blocking.

Note

As the name suggests, this is effective at blocking individual hosts, but not entire domains (or subdomains).

--- Enabling logging ---

By default, DNS logging is disabled. If you'd like to see which hosts are being blocked, enable it on the DHCP Server > Logging tab by selecting the Log DNS queries toggle. Save settings and Restart Ad Blocking. The Logging tab on the Ad Blocking page will display blacklisted DNS queries with host addresses of

0.0.0.0

. A sample of blocked ad/tracker requests is below.

Code TEXT :

dnsmasq[9633]: config static.ads-twitter.com is 0.0.0.0
dnsmasq[9633]: config tag.bounceexchange.com is 0.0.0.0
dnsmasq[9633]: config cdn.boomtrain.com is 0.0.0.0
dnsmasq[9633]: config securepubads.g.doubleclick.net is 0.0.0.0
dnsmasq[9633]: config c.amazon-adsystem.com is 0.0.0.0
dnsmasq[9633]: config pixel.adsafeprotected.com is 0.0.0.0
dnsmasq[9633]: config ad.doubleclick.net is 0.0.0.0
dnsmasq[9633]: config www.summerhamster.com is 0.0.0.0
dnsmasq[9633]: config c2.taboola.com is 0.0.0.0
dnsmasq[9633]: config ads.servebom.com is 0.0.0.0
dnsmasq[9633]: config s.cpx.to is 0.0.0.0
dnsmasq[9633]: config pixel.quantserve.com is 0.0.0.0
dnsmasq[9633]: config cdn.taboola.com is 0.0.0.0
dnsmasq[9633]: config sdk.iad-01.braze.com is 0.0.0.0

--- Disabling ad block ---

To disable the ad blocking service, slide the Enable blocklists toggle to its off position, then choose Save settings. You may then restart your hotspot for the changes to take effect.

--- About blocklist policies ---

The blocklist sources chosen for RaspAP adhere to these policies:

Should not break useful websites or apps
Blocks tracking servers
Blocks advertising servers
Blocks analytics servers
Blocks scam websites
Blocks malware servers
Blocks webminers
Blocks phishing servers

Users may tailor RaspAP's ad blocking to suit their needs by selecting from multiple blocklist sources. Furthermore, domain blocklists enable full use of domain name based wildcard filtering (for example,

*.baddomain.org

). This reduces the chance of missing any new subdomains and significantly reduces the size of the blocklists.

Access point settings

Sun, 08 Nov 2026 14:23:29 +0100

Basics

After running the Quick installer or following the manual installation steps, RaspAP will start up a routed wireless access point (AP) with a default configuration. As part of this initial setup, the

hostapd

service broadcasts an AP with the following settings:

Interface:

wlan0

SSID:

raspi-webgui

Wireless Mode:

802.11n - 2.4GHz

Channel:

Security Type:

WPA2

Encryption Type:

CCMP

Passphrase:

ChangeMe

Each of these settings may be changed on the Hotspot > Basic and Security tabs to any values you wish. Your changes will be applied and made visible on the broadcasted AP by choosing Save settings followed by Restart hotspot.

At this point, a dialog will appear to indicate the progress of the RaspAP service. This is a Linux

systemd

process that is responsible for starting up several network services in a specific order and timing.

Connecting clients

When the AP is operational, you may connect clients to it by using one of two methods:

Select the SSID from the list of available networks on your device and enter the passphrase.
Scan the QR code displayed on the Hotspot > Security tab and join the AP.

By default, clients are assigned IP addresses from the DHCP range

10.3.141.50 — 10.3.141.254

. These values may be changed in the DHCP options section of the DHCP server settings UI. If for some reason a client is unable to obtain an IP address from your AP, consult this FAQ.

802.11ac 5 GHz

For devices with compatible wireless hardware, RaspAP version 3.0 largely removes the guesswork in creating a 5 GHz access point. It achieves this by being tightly integrated with the wireless regulatory database used by the Linux kernel. Behind the scenes, RaspAP queries

iw

and intelligently matches its output with the 5 GHz channels allowed by

hostapd

, the user space daemon access point software.

From the Hotspot > Advanced tab, select your country from the dropdown then choose Save settings. This sets the wireless regulatory domain for your device. Now, on the Hotspot > Basic tab choose an interface and select the

802.11ac - 5 GHz

wireless mode option. RaspAP will automatically populate the available 5 GHz channels for your country. Select a channel followed by Save settings, then Start or Restart hotspot.

Tip

Not all AC channels may be compatible with your hardware. If your hotspot fails to start, enable

hostapd

service logging by sliding the Logfile output toggle on the Hotspot > Logging tab, followed by Save settings, then Restart hotspot. See this FAQ for more assistance.

If the Channel dropdown and Save settings button are disabled, refer to this FAQ.

Security settings

WPA2 is currently the most secure standard utilizing AES (Advanced Encryption Standard) and a pre-shared key for authentication. WPA2 is also backwards compatible with TKIP to allow interoperability with legacy devices. AES uses the CCMP encryption protocol which is a stronger algorithm for message integrity and confidentiality.

By default, RaspAP's access point is configured with WPA2 and CCMP encryption. You may of course change this to allow legacy clients (older mobile devices, for example) by selecting

TKIP+CCMP

as the encryption type. Choose Save settings and Restart hotspot for your changes to take effect.

WPA3-Personal

Experimental · Insiders only

WPA3 is an improved encryption standard, thanks to Simultaneous Authentication of Equals (SAE) which replaces the Pre-Shared Key (PSK) authentication method used in prior WPA versions. WPA3-Personal allows for better password-based authentication even when using simple passphrases. In general, WPA3-Personal networks with simple passphrases are more difficult to crack by using brute-force, dictionary-based methods, as with WPA/WPA2.

WPA3 also requires the use of Protected Management Frames (PMFs) to increase network security. If you wish to connect AP clients that may not have support for WPA3-Personal or PMFs, a transitional security mode is also available.

Note

The Raspberry Pi's onboard wireless chipsets do not currently support the WPA3 standard. For this reason, in order to use this setting you will need to configure your AP with an external wireless adapter that supports WPA3.

802.11w

Experimental · Insiders only

The 802.11w amendment was introduced as a way to secure Wi-Fi management frames against attacks by ensuring that these frames are legitimately exchanged between an AP and its clients, rather than a malicious third-party. These 802.11w Protected Management Frames (PMFs) can mitigate common types of "deauthentication" and "disassociation" attacks.

Similar to WPA3-Personal, 802.11w may be configured in one of two modes: enabled and required. Enabled allows for mixed operation by allowing legacy devices that do not support 802.11w to associate while also allowing devices that support 802.11w to use the PMF features. Required will prevent clients that do not support 802.11w from associating with the SSID.

Drag & drop widgets

Experimental · Insiders only

The default dashboard layout may be customized to suit your needs. Enable this option from the System > Theme menu by selecting the Dynamic widgets toggle. Next, from the Dashboard click or tap the icon to modify the widgets. Each widget may be resized, dragged and repositioned. Release the widget to drop it into a new location.

Tip

This option works best for large displays. The default dashboard widgets are optimized for mobile devices and smaller displays.

Click or tap the icon a second time when you're done making changes. The new responsive dashboard layout will be saved to your browser's local storage.

Printable signs

Experimental · Insiders only

Beneath the QR code on the Hotspot > Security tab, you will find a link to open a "Wi-Fi connect" sign suitable for printing. Click or tap the link after the printer icon to open a new window with your hotspot's QR code, SSID and password neatly formatted.

To print, select File > Print from your browser's toolbar and adjust print preferences as needed. This feature can be especially useful if you operate a public wireless access point. You may also opt to integrate a captive portal for your visitors.

Advanced options

The above sections cover everything you will need for a basic routed AP. The Hotspot > Advanced tab has several options that allow you to control advanced settings for the Linux

hostapd

service. These are discussed in the following sections.

Bridged AP mode

If you wish to configure RaspAP as a bridged AP, this may be done by sliding the Bridged AP mode toggle, saving settings and restarting the hotspot. Be aware that when the hotspot restarts you will no longer be able to access the web interface from the default

10.1.141.1

address. Refer to this explanation and tips for administering your bridged AP.

WiFi client AP mode

RaspAP has support for this special mode, also known as a micro-AP or simply AP-STA. Typically this can be difficult to configure manually, but RaspAP performs most of the config work behind the scenes for you.

Note

This option is disabled or "greyed out" until a wireless client is configured. This can be done via the WiFi client UI, or by manually configuring a valid

wpa_supplicant.conf

.

Before using this mode, it is recommended that users familiarize themselves with how AP-STA works. Users of AP-STA mode should also be aware of its limitations, and understand that performance and stability of this AP mode will not be equal to using a second wireless adapter bound to a separate interface. For the latter, refer to this FAQ.

Beacon interval

Wireless APs continuously send beacon frames to indicate their presence, traffic load, and capabilities. The default

hostapd

beacon interval is 100ms. If desired, you may change this to any value between 15 and 65535.

Disable disassoc_low_ack

An AP may disassociate a client due to inactivity, transmission failures or other indications of connection loss. This phenomenon can usually be observed in the

hostapd

logs like so:

Code TEXT :

wlan0: AP-STA-DISCONNECTED 24:62:ab:fd:24:34
wlan0: STA 24:62:ab:fd:24:34 IEEE 802.11: disassociated
wlan0: STA 24:62:ab:fd:24:34 IEEE 802.11: deauthenticated due to inactivity (timer DEAUTH/REMOVE)

This option sets the

disassoc_low_ack

boolean value for

hostapd

. Be aware that this value is dependent on driver capabilities. Moreover,

hostapd

may disassociate a client (or station) for a variety of reasons, so this is not a silver bullet.

Transmit power

RaspAP allows you to control the transmit power of the configured AP interface. The default "auto" setting will suffice for the vast majority of APs. A lower

txpower

value can be useful to mitigate WiFi radio interference, for example if you are hosting multiple APs in a given area. It can also be advantageous to set

txpower

to a lower value in IoT or similar applications where reduced power consumption is needed.

Set the transmit power by selecting a value from the dropdown and choosing Save settings. The transmit power setting is expressed as dBm, or decibels (dB) with reference to one milliwatt (mW). It is not necessary to restart the AP for this to take effect.

Maximum number of clients

This option sets the

max_num_sta

value for

hostapd

, and is effective for placing a limit on the number of clients (stations) that can connect to your AP. When the limit is reached, new client connections will be rejected.

Note

The default setting is 2007, but this is merely the value set by

hostapd

from the IEEE 802.11 specification. It should not be interpreted as a guarantee that RaspAP can support this many simultaneous clients. In practice, this number depends on several factors and is a much lower value, as discussed in this FAQ.

Troubleshooting

RaspAP gives you advanced control over several Linux networking-related services. As a result, your AP may fail to start for a variety of reasons. You may also encounter errors connecting clients to the AP, have no internet on AP clients, or observe clients being disconnected from the AP for no apparent reason.

If any of the above happens, one of the best diagnostic tools at your disposal is RaspAP's built-in service logging facility. You may enable the

hostapd

service log by sliding the Logfile output toggle on the Hotspot > Logging tab and choosing Save settings. Finally, choose Restart hotspot and check the log output.

Similarly, you may also enable DHCP server activity by sliding either of the two logging options on the DHCP server > Logging tab.

Debug log

In some situations, you may need more comprehensive information to self-diagnose a problem. RaspAP lets you generate a debug log with a detailed summary of your system including the installed OS, Linux kernel version, attached USB devices, RaspAP settings, network configuration and current state of several AP-related services.

[Image]

To create this log, simply click or tap on the Generate debug log button from the System > Tools tab. You will be prompted to choose a location to store the generated

raspap_debug.log

file on your local computer or mobile device. An example portion of RaspAP's debug log is shown below:

Code TEXT :

System Info
===========
Hardware: Raspberry Pi 3 Model B Rev 1.2
Detected OS: Debian GNU/Linux 12 (bookworm) 64-bit
Kernel: Linux raspberrypi 6.1.0-rpi4-rpi-v8 (2023-10-05) aarch64 GNU/Linux
System Uptime: 4 days, 20 hours, 45 minutes
Memory Usage: 29.0749%
 
Installed Packages
==================
PHP Version: 8.2.7 (cli) (built: Jun  9 2023 19:37:27) (NTS)
Dnsmasq Version: 2.89
dhcpcd Version: 9.4.1
lighttpd Version: 1.4.69
vnStat Version: 2.10
 
RaspAP Install
==============
RaspAP Version: 2.9.9
RaspAP Installation Directory: /var/www/html
RaspAP hostapd.ini contents:
WifiInterface = wlan0

Tip

If you are unable to perform a self-diagnosis and would like to share your debug log (or a portion of it) with another party, upload it to Pastebin or Ubuntu Pastebin. Please don't paste the log in its entirety to RaspAP's discussions, issues or other support channels.

RaspAP's debug log contains information about your system and local network configuration. However, no passwords or other senstive data are included.

Diagnosing problems

Look for any reported errors logged by the

hostapd

dhcpcd

dnsmasq

services. In most cases, errors thrown by one or more of these services have been discussed in various online forums. Start by searching the official Raspberry Pi forums or Raspberry Pi on Stack Exchange. Chances are the problems with your AP have been discussed and answered before.

For additional help and advice, the FAQ is a rich source of troubleshooting info that is continuously updated with answers to the most commonly asked questions. For issues not covered in the FAQ, you may find many topics in RaspAP discussions and the RaspAP subreddit.

Tip

Capture output from the Linux kernel's message buffer with

dmesg

to help diagnose failure events. Read the last 100 lines with

dmesg | tail -100

and look for any anomalies.

The performance of WiFi radios may be impacted by many factors, including, but not limited to:

Undervoltage due to inadequate power or too many peripherals connected to the USB bus
Interference from a poorly shielded HDMI cable or using a specific HDMI screen resolution
RF interference from overlapping WiFi networks on a crowded 2.4 GHz band.

Bear these things in mind if your AP exhibits unexpected behavior and do your best to mitigate them.

Reverting to base settings

It is generally advisable to begin with RaspAP's default configuration, which has been rigorously tested and validated with the project's supported operating systems. If, after modifying RaspAP's default settings, your AP no longer functions as expected, you may perform a system reset to restore these defaults.

Accessing backups

Each time you revert to RaspAP's base settings, your existing service configuration files are automatically backed up to

/etc/raspap/backups

. In this way, you can compare differences between your files and the default configuration, if needed. There are many ways to do this in Linux, such as using the built-in GNU

diff

tool. Another option is to install

colordiff

, a wrapper for diff that produces the same output but with colored syntax highligting. Install

colordiff

with

sudo apt-get install colordiff

.

Similarly, the web files located in the default

/var/www/html

root are backed up to

/var/www

in a directory named with a timestamp. Therefore, any changes you've made to RaspAP's internals are preserved.

AP-STA mode

Sun, 08 Nov 2026 14:23:29 +0100

Overview Experimental (Unsupported)

This walkthrough describes an installation of RaspAP on the Raspberry Pi Zero W or Zero 2 W models. However, the same steps apply to any device with a chipset capable of supporting this mode.

A managed mode AP, variously known as WiFi client AP mode, a micro-AP or simply AP-STA, usually works with the Quick Installer if the steps below are followed carefully. This feature was added to RaspAP specifically to support Internet of Things (IoT) and embedded applications for the Pi Zero W, however it is equally useful for a broad range of projects.

Disclaimer

This mode is completely unsupported and should be used for educational purposes only. If you need a reliable solution with an access point (AP) and wireless client (STA) on the same device, buy a second Wi-Fi adapter and follow this FAQ instead.

[Image]

Before proceeding with the installation, it's important to have a basic understanding of how AP-STA works.

What is AP-STA mode?

Many wireless devices support simultaneous operation as both an access point (AP) and as a wireless client/station (STA). This is sometimes called Wi-Fi AP/STA concurrency. In this configuration, it is possible to create a software AP acting as a wireless repeater for an existing network, using a single wireless device. This capability is listed in the following section in the output of

iw list

Code TEXT :

$ iw list | grep -A 4 'valid interface'
valid interface combinations:
* #{ managed } <= 1, #{ P2P-device } <= 1, #{ P2P-client, P2P-GO } <= 1,
total <= 3, #channels <= 2
* #{ managed } <= 1, #{ AP } <= 1, #{ P2P-client } <= 1, #{ P2P-device } <= 1,
total <= 4, #channels <= 1

The second valid interface combination indicates that both a

managed

and

AP

configuration is possible. The constraint

#channels <= 1

means that your software AP must operate on the same channel as your Wi-Fi client connection.

Note

If you have a second wireless adapter bound to

wlan1

on a Pi Zero W (or other device), refer to this FAQ.

Use cases

There are many scenarios in which AP-STA mode might be useful. These are some of the more popular ones:

A device that connects to a wireless AP but needs an admin interface to configure the network and/or other services.
A hub for Internet of Things devices, while also creating a bridge between them and the internet.
A guest interface to your home wireless network.

Security is an important consideration with IoT and it can be beneficial to keep your devices on a separate network, for safety’s sake. No one wants a random internet user turning your lights on and off.

How does AP-STA work?

In this configuration, we create a virtual network interface (here

uap0

) and add it as the AP to the physical

wlan0

device. This virtual interface is used by several of the services needed to operate a software access point. RaspAP manages these configurations in the background for you. Relevant sections are displayed below as examples.

dhcpcd.conf

Code TEXT :

# RaspAP uap0 configuration
interface uap0
static ip_address=192.168.50.1/24
nohook wpa_supplicant

hostapd.conf

Code TEXT :

# RaspAP wireless client AP mode
interface=uap0

dnsmasq.conf

Code TEXT :

# RaspAP uap0 configuration
interface=lo,uap0               # Use interfaces lo and uap0
bind-interfaces                 # Bind to the interfaces
domain-needed                   # Don't forward short names
bogus-priv                      # Never forward addresses in the non-routed address spaces

On AP-STA startup and system reboots, RaspAP's service control script adds the virtual

uap0

interface and brings it up, like so:

Code TEXT :

iw dev wlan0 interface add uap0 type __ap
ifconfig uap0 up

After the virtual

uap0

interface is added to the

wlan0

physical device, we can then start up

hostapd

. It is important that the virtual interface is brought up first, otherwise it will fail with the message "could not configure driver mode". We also need to be sure that the interface is not managed by

systemd-networkd

, so this service should be disabled. These steps are handled by the RaspAP daemon.

With a basic understanding of AP-STA mode, we can proceed with the installation.

Installation

Begin by flashing an SD card with the latest release of Raspberry Pi OS (32- or 64-bit) Lite.
Prepare the SD card to connect to your WiFi network in headless mode according to this FAQ.
Enable
```
ssh
```
access by creating an empty file called "ssh" (no extension) in the SD card's root.
Insert the SD card into the Pi Zero W and connect it to power. Note: the standard power supply for the Raspberry Pi is 5.1V @ 2.5A. Other power sources may result in undervoltage or other issues. Do not use the micro USB connection.
Connect to your Pi via ssh.
```
ssh pi@raspberrypi.local
```
is typical.
Follow the project prerequisites exactly. Do not skip any of these steps.

Invoke the Quick Installer as normal:

curl -sL https://install.raspap.com | bash

The installer automatically detects a Pi (or other device) without an active
```
eth0
```
interface. In this case, you will not be prompted to reboot your Pi.
Open the RaspAP admin interface in your browser, usually
```
http://raspberrypi.local
```
.
The status widget should indicate that hostapd is inactive. This is expected.
Confirm that the Wireless Client dashboard widget displays an active connection.
Choose Hotspot > Advanced and enable the WiFi client AP mode option.
Optionally, enable Logfile output as this is often helpful for troubleshooting.
Choose Save settings and Start hotspot.
Wait a few moments and confirm that your AP has started.

Note

The WiFi client AP mode option will be disabled, or "greyed out", until a wireless client is configured.

When to reboot?

Rebooting before configuring AP-STA mode is likely the main cause of problems for users with the Pi Zero W. The reason is the default configuration is designed for a wired (ethernet) AP.

Once the Pi Zero W is configured in AP-STA mode, RaspAP will store several values in

/etc/raspap/hostapd.ini

Code TEXT :

LogEnable = 1
WifiAPEnable = 1
BridgedEnable = 0
WifiManaged = wlan0

These are used by RaspAP's systemd control service

raspapd

to determine that a managed mode AP is enabled for the Pi and restore the connection after subsequent reboots.

Changing hostapd settings

Changes to the hotspot configuration should be applied to the

wlan0

physical device, not

uap0

(a virtual interface). In other words, if you wish to change

hostapd

settings, stop the hotspot, disable AP-STA, make your config changes on

wlan0

, re-enable AP-STA and finally restart hostapd. An explanation is available here.

Bridged AP mode

Sun, 08 Nov 2026 14:23:29 +0100

Overview

By default RaspAP configures a routed AP as its hotspot, where your RPi creates a subnet and assigns IP addresses to its hotspot clients. If you would rather have your upstream router assign IP addresses, RaspAP lets you change the hotspot configuration to an alternative bridged AP. This is also useful if you want your RPi and its hotspot clients to be visible to other devices in your router's network.

Toggling bridged AP mode

In the RaspAP web interface, go to Hotspot > Advanced tab, then slide the Bridged AP mode toggle. Save settings then Restart hotspot.

Limitations

Bridged AP mode has some limitations compared to RaspAP's default routed AP.

On the Hotspot > Advanced tab the Wifi Client AP mode option is disabled. Your RPi cannot connect as a client to another Wifi network while simultaneously hosting its own bridged AP (hotspot).

The DHCP Server page is disabled. The reason for this is in bridged AP mode, your upstream router is the DHCP server. Use your router's web interface to configure DHCP settings.

Clients connected to a bridged AP with OpenVPN enabled will not have their traffic routed through the VPN server. Your RPi itself will still have its own traffic routed through the VPN server.

Note

Bridged AP mode is not currently supported on Ubuntu Server.

Accessing the web interface

In bridged AP mode, you will no longer be able to access RaspAP's web interface using the default 10.3.141.1 address. This is because your RPi no longer creates its own 10.3.141.0/24 subnet for its hotspot. Instead, access RaspAP's web interface by entering your RPi's hostname followed by

.local

. By default this will look like

raspberrypi.local

.

Some browsers have trouble resolving

.local

addresses. You might have to modify the address depending on your browser:

http://raspberrypi.local

raspberrypi.local/

.

If the above methods don't work, the

nmap

command (Network Mapper) can be used to scan your subnet for devices connected to your network. For example, invoke

nmap

with the

-sn

flag (ping scan) on your subnet range:

Code TEXT :

nmap -sn 192.168.1.0/24

This scan pings all the IP addresses in a subnet to see if they respond. For each device that responds to the ping, the output will show the hostname and IP address like so:

Code TEXT :

Starting Nmap 7.80 ( https://nmap.org ) at 2021-01-23 10:04 CET
Nmap scan report for iPhone 192.168.1.31
Host is up (0.037s latency).
Nmap scan report for raspberrypi 192.168.1.8
Host is up (0.031s latency).
Nmap scan report for Chromecast 192.168.1.45
Host is up (0.0015s latency).
Nmap scan report for mbp15 192.168.1.48
Host is up (0.074s latency).
Nmap done: 256 IP addresses (4 hosts up) scanned in 6.08 seconds

More information on finding your RPi's IP address can be found here.

Troubleshooting

If you are unable to connect clients to your bridged AP, start by following the recommendations in this FAQ. Client connectivity issues in bridged AP mode are most often the result of your router, not RaspAP. Check your router's web interface and DHCP settings before reporting a bug.

Default settings

Sun, 08 Nov 2026 14:23:29 +0100

Overview

Creating a software routed access point (AP) requires the installation and setup of several related Linux services. RaspAP uses a known-good default configuration as a starting point. This facilitates a faster setup by not prompting the user for various network settings during the installation. More importantly, it eliminates guesswork that can lead to conflicts down the road. When the manual or quick installation is completed, you will have a functional AP that you may then administer with RaspAP's web interface.

While this project handles every facet of this process for you, it's still recommended that users familiarize themselves with the steps involved in building a software AP from start to finish.

Configuration directory

To every extent possible, RaspAP's default settings are contained within the project's

/config

folder. The networking defaults, DNS servers, wireless regulatory data and so on are found here. In this way, the user may modify RaspAP's baseline application settings without touching code.

The exception to this is

hostapd.conf

which is managed by

includes/hostapd.php

and effectively rewritten depending on user input. This is due to the complexity of this configuration relative to other services managed by the project. For this reason, manual edits to this file will not be preserved.

Baseline configurations for

dhcpcd

dnsmasq

(described below) and bridged AP configurations are contained here.

Managing config values

The interface itself, default Linux file paths and so on may be changed by modifying the project's configuration file

config.php

.

Note

The file

config/config.php

is copied during the installation to

includes/config.php

and ignored by Git. This way, users can modify

includes/config.php

without

git pull

or upgrades complaining about local changes. The file

includes/defaults.php

loads corresponding default values if they are not set.

For example, you can change the brand text that appears in the interface header simply by modifying the value of this constant:

Code TEXT :

define('RASPI_BRAND_TEXT', 'RaspAP');

RaspAP's interface may be further customized by changing the following values:

Code TEXT :

// Optional services, set to true to enable.
define('RASPI_WIFICLIENT_ENABLED', true);
define('RASPI_HOTSPOT_ENABLED', true);
define('RASPI_NETWORK_ENABLED', true);
define('RASPI_DHCP_ENABLED', true);
define('RASPI_ADBLOCK_ENABLED', false);
define('RASPI_OPENVPN_ENABLED', false);
define('RASPI_WIREGUARD_ENABLED', false);
define('RASPI_TORPROXY_ENABLED', false);
define('RASPI_CONFAUTH_ENABLED', true);
define('RASPI_CHANGETHEME_ENABLED', true);
define('RASPI_VNSTAT_ENABLED', true);
define('RASPI_SYSTEM_ENABLED', true);
define('RASPI_MONITOR_ENABLED', false);

The constants defined for Linux configuration file paths are typical and needn't be changed, in most cases. However, you could easily do so simply by modifying this file.

Networking defaults

The default AP interface used by RaspAP is

wlan0

. This is a typical setting if you are using the RPi's onboard wireless adapter. You can change this to a different interface by modifying the following value in

config.php

Code TEXT :

define('RASPI_WIFI_AP_INTERFACE', 'wlan0');

Info

If a second wireless adapter is configured for your device, for example bound to the

wlan1

interface, RaspAP will automatically detect it and assign it as the default

wireless client interface. You may change this setting simply by selecting

wlan1

as the AP interface in the Hotspot > Basic panel. After restarting the hotspot, RaspAP will use

wlan0

as the client interface.

Default values for the

dnsmasq

and

dhcpcd

services can be modified as well. The file

config/defaults.json

was introduced with the version 2.6 release. This file is copied during the installation to

/etc/raspap/networking/

, so any changes to it must be made here.

The

defaults.json

file uses the standard JSON data-interchange format. For example, the default

dhcp

settings for

wlan0

are displayed below:

Code TEXT :

"dhcp": {
"wlan0": {
"static ip_address": [ "10.3.141.1/24" ],
"static routers": [ "10.3.141.1" ],
"static domain_name_server": [ "1.1.1.1 8.8.8.8" ],
"subnetmask": [ "255.255.255.0" ]
}

Likewise, the DHCP ranges for both

wlan0

and the virtual

uap0

interface are shown below:

Code TEXT :

"dnsmasq": {
"wlan0": {
"dhcp-range": [ "10.3.141.50,10.3.141.254,255.255.255.0,12h" ]
},
"uap0": {
"dhcp-range": [ "192.168.50.50,192.168.50.150,12h" ]
}

These default settings are defined as fallback values. That is, if a user-defined value is missing these will be used in their place.

DNS servers

The list of hosted DNS servers available in the Upstream DNS servers panel in DHCP > Advanced may be modified to suit your needs. The file

config/dns-servers.json

contains a JSON formatted collection of hostnames and IPv4 addresses, like so:

Code TEXT :

"Google": [
"8.8.4.4",
"8.8.8.8"
],
"OpenDNS": [
"208.67.220.220",
"208.67.222.222"
],
"Quad9": [
"9.9.9.9"
],

Edits to this file in place will immediately be reflected in the user interface.

VPN providers

RaspAP version 3.0 introduced beta support for a select number of VPN providers. These services are largely defined in the

config/vpn-providers.json

file. An example provider definiton is shown below:

Code TEXT :

"id": 1,
"name": "ExpressVPN",
"bin_path": "/usr/bin/expressvpn",
"install_page": "https://www.expressvpn.com/support/vpn-setup/app-for-linux/",
"account_page": "https://www.expressvpn.com/subscriptions",
"cmd_overrides": {
"countries": "list all",
"log": "diagnostics",
"version": "-v"
}

It is not necessary to modify these definitions, unless you would like to experiment by adding a provider not currently supported by RaspAP.

Restoring settings

If you've modified RaspAP's default configuration and the AP no longer works as expected, the defaults may be restored by performing a system reset. From the System > Tools tab, click or tap the Perform reset button. A dialog will appear to confirm this action.

[Image]

Alternatively, you may follow the steps described in the manual installation.

Dynamic DNS

Sun, 08 Nov 2026 14:23:29 +0100

Overview Experimental · Insiders only

Accessing your device from anywhere in your local network is great, but there are times when you might want it to be reachable from remote locations. This is particularly true for projects such as media servers, network attached storage (NAS) and VPNs such as those provided by RaspAP. However, due to the shortage of IPv4 addresses, it's likely that you will receive a new and different external IP address from your ISP each time your router is rebooted.

Some ISPs offer a static external IP address, although often at an additional cost above a basic subscription. This is where using a Dynamic DNS (or DDNS) service on your home network can be extremely useful.

Solution

Dynamic DNS solves this problem by providing a domain name that always points to the current IP address of your device, regardless of how often it changes. With DDNS, the IP assigned to your domain name is automatically updated by a piece of software (known as a daemon) running on your device. This means that you can access the server using the same domain name, without having to constantly update settings each time the IP address changes.

The daemon running on your device resolves your external IP address using one of several methods, then reports this to your DDNS provider. There are a number of different providers that offer Dynamics DNS free of charge. If you currently own a custom domain name, chances are your registrar provides DDNS or has a partner to support this.

Installation

The Quick installer will give you the option to add the required packages to your system, and enable the configuration page in RaspAP. Simply press Enter at the prompt to accept the default "Y" (yes) response:

Code TEXT :

Install ddclient and enable DDNS configuration? [Y/n]:

When the installer completes, you will be able to administer the

ddclient

service as described in the sections below.

Basic settings

All the configuration settings needed to enable Dynamic DNS on your device are available on the Basic settings tab. These are described in the next section.

Service provider

RaspAP makes use of the proven ddclient open source software for Linux to update dynamic DNS entries. The

ddclient

software is highly configurable and provides a daemon that updates your external IP at scheduled intervals. Many popular Dynamic DNS services are supported by

ddclient

and RaspAP.

Instructions on how to setup your domain for DDNS vary by provider, but the process is generally similar. Begin by selecting a Service provider from the dropdown. RaspAP will assist you by automatically populating the Protocol and Server fields. You may also manually configure the details for your service if so desired.

Note

Some DDNS providers, such as NoIP, distribute their own Linux client to use with their service. It isn't necessary to install this software because the

ddclient

daemon already includes this functionality.

Method to obtain IP

There are a variety of different methods to determine your external IP address. A popular one involves a discovery page on the web that resolves your IP. If you choose this method, enter it in the Web address field after selecting this option from the Method to obtain IP select.

Tip

There are many freely available external IP discovery pages you can use. Examples include ChangeIP and this one from Namecheap. Each of these pages perform the same basic function.

Alternatively, you may want to use an IP address from a network interface, your router's firewall status page, or an external command. Each of these options can be specified, thereby giving you a great deal of flexibility.

Enter your DDNS service credentials in the Username and Password fields. Finally, specify the Domain to be updated that will be associated with your device. DDNS providers may also refer to this as a "zone" or "host". These definitions may take several forms, for example:

Code TEXT :

myhost.dyndns.org
mydomain.com
@.mydomain.com

Check with your DDNS service provider to determine which entry is best for your configuration. To complete your setup, choose Save settings now or proceed with advanced options.

Advanced settings

A subset of advanced options are provided for your configuration. These are not required for the DDNS service to be functional, but may be adjusted to suit your needs.

Enable SSL

You may wish to Enable SSL to ensure that your credentials are not sent over the internet unencrypted. Not all providers support this, however, so this option is disabled by default. Enabling this option for a non-SSL supported provider may result in a connection timeout. Errors such as these have been reported:

Code TEXT :

WARNING:  cannot connect to checkip.dyndns.org:443 socket: Connection timed out SSL connect attempt failed
WARNING:  found neither IPv4 nor IPv6 address
DEBUG:    get_ip: using web, http://checkip.dyndns.org/ reports 
WARNING:  unable to determine IP address

For this reason, it's recommended to check with your DDNS service provider before enabling this.

Daemon check interval

Finally, you may define the Daemon check interval to control the length of time between updates performed by

ddclient

in the background. This value is specified in milliseconds and defaults to 300.

When you've completed your configuration, choose Save settings and Start Dynamic DNS.

Troubleshooting

Behind the scenes, the

ddclient

daemon will determine your external IP using the method you've defined and send this to your DDNS provider. Your provider will then update the IP address corresponding to the DNS "A" (or "address") record for your domain.

If your DDNS provider fails to report your current IP address, or you suspect there might be a problem with the

ddclient

configuration on your device, you may generate a detailed debug log.

From the Logging tab, use the Generate log button to invoke the

ddclient

daemon and output a troubleshooting log:

This will provide a verbose output of everything

ddclient

is doing. If it ends with a

SUCCESS

message this indicates that the daemon successfully checked and updated the DNS "A" record with your provider, if neccessary. An example of this is shown below:

Code TEXT :

RECEIVE:  140.82.121.3
DEBUG:    get_ip: using web
dynamicdns.park-your-domain.com/getip reports 140.82.121.3
SUCCESS:  @.mydomain.com: skipped: IP address was already set to 140.82.121.3.

If the daemon doesn’t reply with

SUCCESS

, the debug output should give you some clues as to what the problem is.

Port forwarding

ddclient

has successfully updated your DDNS provider's "A" record with your IP address, but you are unable to access your device remotely, it's likely your router needs to be configured for port forwarding. This instructs the router to send, or forward, data packets from the external WAN interface to the internal IP address belonging to your device.

You can enable this by using your router's port mapping/forwarding setup. This procedure allows remote computers to connect to a specific device within your internal LAN's private address space. Specifics are highly dependent on the router you have, although the steps are generally straightforward. Consult your router's documentation for details.

Demilitarized zone

An alternative to forwarding specific ports to an internal IP is using a demilitarized zone (DMZ). A home router DMZ is a host on an internal network that has all UDP and TCP ports open and exposed, except those ports otherwise forwarded. By using this method, all the ports (and services) of your device will be directly accessible from the internet, with the attendant security risks that this implies.

This setup is often desirable when a host is running multiple public-facing services that need to be accessed over the internet. In this context, a DMZ provides greater isolation and granular control than is possible with port forwarding. It's also possible to configure different security policies for various DMZ segments. For these reasons, a properly configured DMZ can be a more secure way to expose services to the internet than port forwarding.

The specifics of creating a DMZ are beyond the scope of this document, although at minimum a firewall is strongly advised.

Discussions

Questions or comments about using Dynamic DNS? Join the discussion here.

FAQ

Sun, 08 Nov 2026 14:23:29 +0100

This guide was written to address some frequently asked questions among users of RaspAP. FAQ items are organized into thematic sections, below, for easier reference.

If you would like to see a new FAQ that you feel would assist other users, start a discussion or open an issue.

General

Troubleshooting

Integrations

OpenVPN

WireGuard

Networking

Install & upgrade

Why isn't there support for Desktop distributions?

A desktop distribution (or "distro") usually has a very different set of programs that handles various underlying OS functions and wraps it with a pretty GUI. Since RaspAP does quite a bit of configuration on top of a known default starting point, the more distros a project supports the bigger the task of handling these variations.

It becomes increasingly difficult for a small team of developers to support a wide variety of targets. The RaspAP team could spend their precious and rare development time troubleshooting one-offs and edge cases, or work on new features and bug fixes. For this reason, we've chosen to include support for a narrow, but diverse, subset of compatible operating systems.

What do all these settings in the UI do? Changing them seems to have no effect.

RaspAP manipulates several daemons, services and helper programs behind the scenes for you. In the footer of each management panel is a helpful "Information provided by..." label. These indicate which Linux daemon and/or program is being modified by the UI. Learning what these services are and how they work will go a long way toward demystifying things.

For example, two of the best starting points for understanding

hostapd

(the service that implements 802.11 AP management) include the hostapd Linux documentation page and hostapd Wifi homepage.

Info

After you choose Save settings for

hostapd

dhcpcd

, these services must be restarted for your changes to take effect. If you're not sure if your AP is behaving as expected, enable logging in the Logging tab of Hotspot and check the output.

How do I prepare the SD card to connect to WiFi in headless mode?

Since May 2016, Raspbian has been able to copy wifi details from

/boot/wpa_supplicant.conf

into

/etc/wpa_supplicant/wpa_supplicant.conf

to automatically configure wireless network access.

An example

wpa_supplicant.conf

file is shown below. Replace the fields with your settings:

Code TEXT :

ctrl_interface=DIR=/var/run/wpa_supplicant GROUP=netdev
update_config=1
country=your_ISO-3166_two-letter_country_code
 
network={
ssid="my_SSID"
psk="my_PSK"
key_mgmt=WPA-PSK
}

Can I use wlan0 and wlan1 rather than eth0 for my AP?

Yes, this is supported by RaspAP. In this scenario, you may wish to use the

wlan0

interface as the AP interface with

wlan1

as the wireless client interface. Refer to the dedicated WiFi repeater walkthrough for steps to enable this configuration.

Can I use RaspAP as a monitor only, without changing my configuration?

Yes, RaspAP has support for a so-called "monitor mode". In

config.php

change the setting

RASPI_MONITOR_ENABLED

true

. This disables the ability to modify settings, start/stop daemons, shutdown or reboot the RPi. RaspAP will continue to report interface statistics, service settings and data usage as normal. See this for more information.

Can I use RaspAP with my custom dnsmasq configuration?

Yes, RaspAP supports this through the use of

dnsmasq.d

. The primary

/etc/dnsmasq.d/090_raspap.conf

managed by the UI includes the following directive to enable your custom .conf files:

Code TEXT :

conf-dir=/etc/dnsmasq.d

Configuration files placed in this directory will be used by the dnsmasq service and are untouched by the UI.

What is the maximum number of simultaneous clients that I can connect to my AP?

Short answer: it depends.

Longer answer: there are several factors that come into play including, but not limited to, the specific RPi model, firmware version, available RAM and so on.

Every update to the RPi's firmware takes up more of the limited RAM reserved for WiFi, resulting in less space to host AP clients. Users of RaspAP have reported up to 19 simultaneous clients with a RPi 3B, but a smaller number with a newer RPi model. If you are willing to modify your device's firmware and replace the

brcmfmac

driver with a specific version, a maximum of 20 simultaneous WiFi clients is theoretically possible.

Bottom line: if maximizing AP clients is your primary goal, you will have to either use a specific firmware version or purchase an external wireless adapter.

See also: https://github.com/raspberrypi/linux/issues/3010.

Where can I find a list of USB WiFi adapters that use in-kernel drivers?

There are many USB WiFi adapters that work without the need to install a driver in Linux. The term "in-kernel" refers to drivers that are packaged and maintained by the Linux kernel.

This GitHub list currently has 60 links to USB WiFi adapters that work without installing drivers (ie., "plug and play") on devices like the Raspberry Pi.

With adapters that use in-kernel drivers, you may simply plug the adapter in and it will work. Many people find that using adapters with in-kernel drivers is a better solution than buying an adapter that requires drivers to be found, downloaded, compiled, installed, fixed and reinstalled.

What are the passphrase requirements used by RaspAP?

The requirements are based on IEEE standard 802.11i-2004 which defines a passphrase as a sequence of between 8 and 63 ASCII-encoded characters. Furthermore, each character in the passphrase must have a decimal encoding in the range of 32 to 126 (IEEE Std. 802.11i-2004, Annex H.4.1). These are often known as printable characters that represent letters, digits, punctuation marks and a few miscellaneous symbols.

This means that so-called special characters, or extended ASCII codes, are not permitted in a passphrase. For example, the Euro sign "€", German "ä" and British pound symbol "£" fall outside this range.

RaspAP will automatically generate a secure passphrase, or PSK, for you. On the Hotspot > Security tab, click or tap the magic icon next to the PSK input. Choose Save settings and Restart hotspot for the changes to take effect.

Can I remove the AP password to create an open WiFi network?

Yes. On the Hotspot > Security tab, select 'None' for Security type. Choose Save settings and Restart hotspot for the changes to take effect.

How do I prevent WAN access to RaspAP's web administration?

There are two ways to do this. The simplest method is to set the web server's bind address in RaspAP's System > Advanced tab to the IPv4 address you wish to grant access to. Choose Save settings and Restart lighttpd. After this is done, the web server will refuse connections to all IP addresses other than the one you've defined.

A somewhat cleaner method with a "403 Forbidden" response can be done manually with lighttpd. You could modify lighttpd's main config directly, but to keep things neater we can use RaspAP's own configuration in lighttpd's

/conf-available

directory. Edit it like so:

Code TEXT :

sudo nano /etc/lighttpd/conf-available/50-raspap-router.conf

Add the following to the end, substituting the

192.168.0.0/16

private IPv4 address range (192.168.0.0 – 192.168.255.255) for your own network:

Code TEXT :

# deny access to RaspAP admin for users that
# are not in the 192.168.0.0/16 network
$HTTP["remoteip"] != "192.168.0.0/16" {
url.access-deny = ( "" )
}

Save and exit the file, then restart the lighttpd service:

Code TEXT :

sudo systemctl restart lighttpd.service

Clients outside of your defined network range will receive a '403' response when accessing the web UI.

Can I reduce the risk of SD card corruption and extend a card's lifespan?

Yes. RaspAP has developed a minimal write mode that substantially reduces disk I/O activity and helps to extend the life of microSD cards.

My 802.11ac 5 GHz hotspot failed to start. What now?

RaspAP uses

iw

and the

wireless-regdb

to determine which channels are allowed for your configured country. However, not all channels may be supported by your device's wireless adapter or firmware. If your 5 GHz access point fails to start, use the steps below to troubleshoot the problem.

Begin by enabling

hostapd

service logging by sliding the Logfile output toggle on the Hotspot > Logging tab. Choose Save settings followed by Restart hotspot and check the log output. The logs will often indicate when a selected channel is not supported by the hardware. For example:

Code TEXT :

wlan0: IEEE 802.11 Hardware does not support configured channel
Could not select hw_mode and channel. (-3)

This may occur with the Raspberry Pi or another device's onboard wireless chipset, or an external wireless adapter. To mitigate this, select one of the following 5 GHz channels:

, then choose Save settings. Click or tap the Clear log button on the Hotspot > Logging tab, if needed, and finally choose Restart hotspot. Check the logs again and see if the error persists.

If the 802.11ac AP still fails to start, an external AC wireless adapter with in-kernel drivers is an option worth considering.

Clients cannot obtain an IP address from the AP.

Clients may receive a "failed to obtain IP address" or similar error message when connecting to your AP. These are the most frequent reasons for this error:

A poor WiFi signal from the access point. In this event, reduce the distance between your device and the AP.
Your device does not operate properly with the encryption method set by the AP.
The access point is misconfigured.

The first and simplest fix is to reconnect the client to your WiFi network. When you do this, the AP forgets the previous attempt and initiates a new process to assign an IP address to your device. Exact methods vary between devices, however most will have a 'Forget this network' option or similar in the WiFi settings. This is shown in iOS, below:

If clients still fail to connect, restart the AP. You may do this by choosing Restart hotspot from RaspAP. This reinitializes several related services in a predictable order and timing. Assuming these services are configured to restart automatically on reboot (the default behavior when RaspAP's installer is used) you may also simply reboot your Pi.

RaspAP gives you control over many aspects of your WiFi network, including DHCP. With its default settings, RaspAP has been rigorously tested and validated to provide connectivity in routed AP mode. If you suspect that RaspAP is misconfigured and not providing IP addresses to clients, you may troubleshoot this yourself.

Clients connecting to your AP are assigned, or leased, an IP address with

dnsmasq

. You can see how this process works by enabling the Log DHCP requests option in the DHCP Server > Logging tab. When a client connects to your AP, a typical

dnsmasq-dhcp

exchange follows this pattern:

Code TEXT :

dnsmasq-dhcp[2516]: DHCPDISCOVER(wlan0) [MAC address]
dnsmasq-dhcp[2516]: DHCPOFFER(wlan0) 10.3.141.249 [MAC address]
dnsmasq-dhcp[2516]: DHCPREQUEST(wlan0) 10.3.141.249 [MAC address]
dnsmasq-dhcp[2516]: DHCPACK(wlan0) 10.3.141.249 [MAC address] iPhone

If one or more steps in this exchange are missing, either your device is unable to respond to the server's

DHCPOFFER

or the AP itself is misconfigured.

Tip

By default, the

dnsmasq

service listens on TCP/UDP port 53 and UDP port 67. If you have configured firewall software such as

ufw

iptables

to filter traffic on these ports, the service may not be able to respond to DHCP requests.

As a last resort, you can assign a static IP address to your device. Copy the MAC address for your device as it appears above and create a new entry in RaspAP's DHCP Server > Static Leases tab. Save settings, restart

dnsmasq

and try connecting your client again.

My WiFi network disappeared and I can't access the web UI

If you are running your Pi headless and are unable to access RaspAP's web interface from the default

http://10.3.141.1/

address, do the following:

Be sure your browser isn't forcing SSL by appending
```
https://
```
to the address, which can result in misleading errors. This may sound obvious but it's reported frequently. (Related: add SSL support for RaspAP.
Connect your device to wired ethernet and access it via the browser or SSH on the
```
eth0
```
interface using one of the methods described below. Check the logs for hostapd errors and reconfigure the service, or run the installer again to restore the default configuration.
There are several methods you can use to determine your Pi's IP address. RaspAP's installer only configures a static IP address for the AP interface on
```
wlan0
```
. If the AP has entered a failed state, you may still be able to connect on an alternate interface.
Recent versions of the RPi OS kernel include the
```
avahi-daemon
```
which facilitates local network discovery via multicast DNS (mDNS). On client computers with the Bonjour service installed (all macOS machines and Windows PCs with Apple iTunes), try accessing your Pi by entering http://raspberrypi.local/ in the browser or via SSH with
```
ssh pi@raspberrypi.local
```
.
If you don't have access to wired ethernet or the above methods fail, configure your Pi for USB-OTG, also known as "on-the-go" or gadget mode. Instructions for enabling USB-OTG vary between various models and not all Pi hardware has support for this.

My custom hostapd.conf / php.ini is gone.

The installer applies a "known good" default configuration to some services, including

hostapd

. It will also, optionally, optimize PHP by changing a very limited number of settings. Your custom configurations haven't been lost however; they've been moved to the backups directory in

/etc/raspap/backups

.

You are free to SSH in to restore those files to their rightful position. However, you may need to ensure that the RaspAP modifications are applied to your own custom configurations.

I changed the admin password and forgot what it was.

/etc/raspap/raspap.auth

. The password is encrypted and cannot be edited manually. However, deleting this file with

sudo rm /etc/raspap/raspap.auth

will restore the default admin password.

RaspAP control panel works but there is no WiFi after reboot.

This problem often occurs when another program tries to reconfigure hostapd at startup. It can also happen when your RPi is configured as both a WiFi client and access point, also known as a managed mode AP. To address this, RaspAP has added a

systemd

init service to bring up networking services in a predictable order and timing after the Linux kernel is booted. You can check the status of this service with:

Code TEXT :

sudo systemctl status raspapd.service

The

raspapd.service

is optionally installed and enabled by the Quick Installer. It is also included in the manual setup steps.

Bridged AP mode is unstable or clients can't connect.

RaspAP delegates all DHCP control to your router in bridged AP mode. If you have trouble connecting clients, start with this project's default configuration in routed AP mode first and try connecting a client. Enable logging for DHCP and hostapd to help you identify any problems. If you have no issues with client connectivity with the default routed AP, but cannot connect clients in bridged AP mode, in most cases the problem lies with your router—not RaspAP. Check your router's web interface and DHCP settings.

If clients disconnect intermittently, this often indicates an undervoltage issue with your RPi. Check the kernel log for any

Under-voltage detected!

errors. Be sure you are using an official 5.1V power supply (each model has different power requirements) and detach any USB devices. Executing

dmesg | grep br0

can also offer clues. Execute

sudo dhclient -v

to gain insights into DHCP requests between your device and router. A typical DHCP exchange follows this pattern:

Code TEXT :

CLIENT -> DHCPDISCOVER
SERVER -> DHCPOFFER
CLIENT -> DHCPREQUEST
SERVER -> DHCPACK

If your device (the client) broadcasts

DHCPDISCOVER

, but there is no

DHCPOFFER

response from your router, you have a misconfiguration or other issue with your network. Troubleshooting client connectivity in bridged AP mode is not supported. No hard feelings.

Managed mode AP doesn't work on the Pi Zero W.

See this walkthrough where the installation is described in detail.

WiFi scanning doesn't work or I get the error cannot execute "wpa_cli reconfigure" .

On some configurations, the Configure WiFi client panel may appear empty. This project uses the

wpa_supplicant

command line client

wpa_cli

to populate a list of available wireless networks. If you can't execute this from the shell, neither can the web UI. For example, the results of this command:

Code TEXT :

sudo wpa_cli -i wlan0 scan_results
Failed to connect to non-global ctrl_ifname: wlan0  error: No such file or directory

...indicate a problem with the socket used to communicate with

wpa_supplicant

. You may also encounter errors such as "Could not connect to wpa_supplicant: wlan0 - re-trying".

If this happens, first check the contents of

wpa_supplicant

with

sudo cat /etc/wpa_supplicant/wpa_supplicant.conf

. You should see, at minimum, the following:

Code TEXT :

ctrl_interface=DIR=/var/run/wpa_supplicant GROUP=netdev
update_config=1

The above is present on clean installs of Raspbian. If you've made changes to this file, ensure that these lines appear first. Next, reinitialize the socket with:

Code TEXT :

sudo wpa_supplicant -B -Dnl80211,wext -c/etc/wpa_supplicant/wpa_supplicant.conf -iwlan0

substituting

wlan0

with your wireless interface, if necessary. You should then be able to perform scans as expected.

Tip

If you are using

wpa_suplicant.conf

to connect to your device with SSH on a wireless interface, do not reboot after running the Quick Installer. More information on this topic is available here.

I started the hotspot but it shows "hostapd down". What's happening?

Hostapd, the Linux service that creates the access point, can fail to start for a variety of reasons. The following are common causes, with troubleshooting advice:

If you've attached an external wireless adapter (bound to
```
wlan1
```
, for example) and have selected this as the AP interface, be sure that it either uses an in-kernel driver, also known as "plug and play" support, or that you have installed the correct driver for it.
Confirm that the 802.11 wireless mode you've selected is supported by the adapter you've chosen in the list of available interfaces. For example, if you've selected the
```
802.11ac 5 GHz
```
wireless mode with incompatible hardware, RaspAP will create the configuration for you but
```
hostapd
```
will fail to start.

In each of these cases, the

hostapd

service will report errors that can be useful for troubleshooting. Enable logging by selecting Logfile output on the Hostapd > Logging tab, choose Save settings then Restart hotspot.

Refer to this FAQ and this FAQ for more info.

Pinging the AP from a connected client computer (or vice versa) results in an intermittent failure. Can I troubleshoot this?

An intermittent ping failure on the wireless interface could indicate any number of things; a poor wireless signal, co-channel interference and disassociated client being among the most common. The following are methods for troubleshooting this:

Get a signal strength report. A signal of -80 dBm or less from your AP is unreliable. If your client computer supports Linux, use
```
sudo iw dev wlan0 scan | awk '/signal:/{sta=$2$3} /SSID:/{print $0" "sta}'
```
and check your AP's dBm value. Alternatively, use any one of several graphical WiFi explorer type tools and obtain your signal strength this way.
Use
```
wavemon
```
on the AP to scan for overlapping channels from nearby APs. Install it with
```
sudo apt install wavemon
```
. If it shows an AP with a strong signal on the same channel as your AP, you are likely experiencing co-channel interference. Select a different channel or band for your AP, restart it and compare the results.
Use
```
mtr
```
to run a continuous scan that reports on latency and percentage packet loss. Install it with
```
sudo apt install mtr-tiny
```
. Obtain your client's IPv4 address from the dashboard or DHCP Server > Client list and start the utility, for example
```
mtr 10.3.141.151
```
. While the scan is running, reposition your client computer and/or your AP and observe the results.
Enable
```
hostapd
```
service logging from RaspAP with Hotspot > Logging > Logfile output, followed by Save settings and restart your AP. Look for errors that indicate clients are being disassociated from the AP. Refer to this FAQ for more info.

My wlan1 keeps being disabled and/or clients are repeatedly disconnected.

Issues such as this can be tricky to diagnose. In this case, an AP is started with an external USB wireless adapter, but client devices are continuously authenticated and disconnected (or "disassociated"). This may appear in

hostapd

service logs like so:

Code TEXT :

wlan1: STA 24:62:ab:fd:24:34 IEEE 802.11: authenticated
wlan1: STA 24:62:ab:fd:24:34 IEEE 802.11: associated (aid 1)
wlan1: AP-STA-CONNECTED 24:62:ab:fd:24:34
wlan1: STA 24:62:ab:fd:24:34 RADIUS: starting accounting session 1D0030DD3176A315
wlan1: STA 24:62:ab:fd:24:34 WPA: pairwise key handshake completed (RSN)
wlan1: AP-STA-DISCONNECTED 24:62:ab:fd:24:34
wlan1: STA 24:62:ab:fd:24:34 IEEE 802.11: disassociated
wlan1: STA 24:62:ab:fd:24:34 IEEE 802.11: deauthenticated due to inactivity (timer DEAUTH/REMOVE)

The AP itself may also fail repeatedly with errors like the following:

Code TEXT :

wlan1: INTERFACE-ENABLED
Failed to set beacon parameters
wlan1: INTERFACE-DISABLED
wlan1: INTERFACE-ENABLED
Failed to set beacon parameters
wlan1: interface state ENABLED->DISABLED
wlan1: AP-DISABLED
wlan1: CTRL-EVENT-TERMINATING

If you see messages indicating "deauthenticated due to inactivity", you can try the "Disable

disassoc_low_ack

" setting on the Hotspot > Advanced tab. Choose Save settings then restart your AP. Monitor the hostapd service logs and see if your clients are able to remain connected.

In this specific case, the user determined that the external RT3070 WiFi adapter was at fault.

RaspAP web UI fails to start or unable to save settings.

After performing a clean install of RaspAP or upgrading an existing installation, the web UI may fail to start or the admin panel may behave in unexpected ways. For example, pages may load but any attempt to save settings will fail. In other cases, the lighttpd web server may fail to respond completely. Errors such as these in

/var/log/lighttpd/error.log

are common:

Code TEXT :

(gw_backend.c.503) bind failed for: unix:/run/lighttpd/php.socket-0: No such file or directory
(gw_backend.c.601) gw-backend failed to start: /usr/bin/php-cgi
(gw_backend.c.1655) [ERROR]: spawning gw failed

These signs point to a corrupted filesystem on the SD card. If during a power disconnection the memory card is in a write operation, there is a high chance that one or more sectors will be damaged. In these cases, a fresh install on a new SD card can save you time and frustration. RaspAP's minimal SD card write mode can help in this case.

Tip

Be sure to use genuine MicroSD cards from a reputable manufacturer. Card clones are common and hard to distinguish from legitimately made ones, but certainly not subject to the same quality standards. Neither fake nor cheap cards are typically suitable for an entire OS to run from.

Why do I receive an 'Invalid CSRF token' message and a blank screen?

A cross-site request forgery (CSRF) is a type of exploit where unauthorized commands are executed against a website on behalf of a trusted user. To guard against this, RaspAP generates a one-time token that is unique for every user and stored in the PHP session object. This token value is inserted into a hidden field on every form in the RaspAP application. If the token doesn’t exist in the submitted form data or fails to match with the token on the server, the form will reject the submission and return an error.

The most common cause for this error message is when your PHP session expires. By default, the PHP session timeout is defined as 24 minutes (1440 seconds). When this timeout is reached stored data will be seen as "garbage" and cleaned up by the garbage collection process.

If you submit a form in RaspAP 24 minutes after the page was loaded, the application will return a CSRF token error. When this occurs, simply refresh the page to generate a new session token.

Can I restore RaspAP's default settings?

Yes, two methods are described here.

How do I integrate RaspAP with Pi-hole?

There have been several discussions around integrating RaspAP with Pi-hole, with the end goal of hosting a complete AP and ad-blocker on a single device. Both projects rely on

dnsmasq

, so integration between them is tricky. There are now several options available to users of RaspAP.

The first option is to configure RaspAP to use a Pi-Hole installation on a separate device. Go to RaspAP's DHCP Server > Advanced page and enable the "Upstream DNS Server" option, add your Pi-Hole's DNS, save settings and restart dnsmasq.
Alternatively, you can run Pi-Hole and RaspAP on the same device by operating RaspAP in bridged mode. Go to RaspAP's Hotspot > Advanced settings page, enable the "Bridged AP mode" option and restart your hotspot.
Install Pi-Hole in a Docker container and proceed with a normal installation of RaspAP on the same device.
Finally, and by popular demand, RaspAP has released its own ad blocking facility with support for custom blocklists.

Can I integrate RaspAP with Adguard Home?

Yes, you can run RaspAP and Adguard Home on the same device. Change Adguard Home’s listening port to

and bind to

127.0.0.1

, then go to RaspAP's > DHCP Server > Advanced page and enable the "Upstream DNS Server". Add

127.0.0.1#5300

as an upstream DNS Server. Save settings and restart dnsmasq. Tip via @firestrife23

Can I configure RaspAP to work with a captive portal?

Yes. The nodogsplash project works just fine with RaspAP and is recommended over other methods. A detailed setup guide is available here.

How do I create an AP activation schedule?

This is a common function in consumer wireless routers. For example, let's assume you want to disable your AP on Monday through Friday between 02:00 and 08:00. You can implement this with

cron

to stop/start RaspAP's service control script at certain times. Run

sudo crontab -e

and add entries like so:

Code TEXT :

# Stop RaspAP services at 02:00 on Monday through Friday
0 2 * * 1-5 sudo /etc/raspap/hostapd/servicestart.sh --action stop
 
# Start RaspAP services at 08:00 on Monday through Friday
0 8 * * 1-5 sudo /etc/raspap/hostapd/servicestart.sh --seconds 3

For help with crontab, head over to crontab.guru.

Can I schedule the WiFi password to change automatically?

Yes. Here's one way to do it using bash. Save the script to your home directory (

/home/pi

for example) and set the execution bit with

sudo chmod +x genpassphrase.sh

. When executed, the script will automatically generate a strong password (or a weaker, pronounceable one), update the

wpa_passphrase

setting in

hostapd.conf

and finally restart the

raspapd.service

. The new passphrase and QR code will be visible on the Hotspot > Security tab.

This can be useful if you're using RaspAP to serve WiFi to clients in a public place, and need to update the passphrase regularly. Similar to creating an AP activation schedule, you can have this execute at specific intervals by using

cron

. Run

sudo crontab -e

and add an entry like so:

Code TEXT :

# Generate a new passphrase and restart RaspAP everyday at midnight
@midnight /home/pi/genpassphrase.sh

For help with crontab, head over to crontab.guru.

Can I configure a managed mode AP without using the UI?

Yes. Let's assume you are creating an RPi OS image (or other supported OS) with scripts that setup RaspAP at first startup. In this scenario, to configure a managed mode AP you must manually connect via a browser, make some changes via the UI and then save your settings. This can be also be done programmatically. Assuming you have

wpa_supplicant.conf

fully populated and a valid

hostapd.conf

, set the following values in

/etc/raspap/hostapd.ini

Code TEXT :

LogEnable = 0
WifiAPEnable = 1
BridgedEnable = 0
WifiManaged = wlan0

substituting

wlan0

for your AP interface, if necessary. You may then restart the raspap daemon with

sudo systemctl restart raspapd.service

Can I configure an alternate port for RaspAP's web service?

Yes. You can now do this from the Advanced tab in System. Manual steps for changing

lighttpd

's default port are included below.

Edit

/etc/lighttpd/lighttpd.conf

and change the following line:

Code TEXT :

server.port                 = 8080

then give the service a kick...

Code TEXT :

sudo systemctl restart lighttpd.service

You can then access RaspAP as before with the new port number in the URI, for example,

http://raspberrypi.local:8080

. This will allow you run another web server alongside lighttpd, if that is your goal.

What breaks RaspAP when Docker is installed on the same system and how I can fix it?

Installing RaspAP after installing Docker often results in connected clients not having internet access from the AP. The reason for this is Docker manipulates

iptables

rules to provide network isolation. Docker installs two custom iptables chains named

DOCKER-USER

and

DOCKER

, and it ensures that incoming packets are always checked by these two chains first. Docker also sets the policy for the

FORWARD

chain to

DROP

.

When RaspAP is started in its default router mode, this will result in the AP not forwarding traffic anymore. If you want RaspAP to continue functioning as a router, you can add explicit

ACCEPT

rules to the

DOCKER-USER

chain to allow it:

sudo iptables -I DOCKER-USER -i src_if -o dst_if -j ACCEPT

When Docker is correctly installed after RaspAP, the following

iptables

chain should be present:

Code TEXT :

Chain INPUT (policy ACCEPT) target prot opt source destination
Chain FORWARD (policy ACCEPT)
target prot opt source destination DOCKER-USER all -- anywhere anywhere
DOCKER-ISOLATION-STAGE-1 all -- anywhere anywhere
ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED DOCKER all -- anywhere anywhere
ACCEPT all -- anywhere anywhere ACCEPT all -- anywhere anywhere
Chain OUTPUT (policy ACCEPT) target prot opt source destination
Chain DOCKER (1 references) target prot opt source destination

Additional info here and here.

tl;dr: Install RaspAP first, followed by Docker, adding the explicit

iptables

rule

sudo iptables -I DOCKER-USER -i src_if -o dst_if -j ACCEPT

Can I integrate RaspAP with OpenMediaVault?

Yes, you can run RaspAP alongside OpenMediaVault for a complete media center and wireless hotspot on a single device. In this way, you are able to share the media storage in your local network via a wireless hotspot while connected to a router via ethernet. This is illustrated in the schematic below:

Code TEXT :

[Router] <---- eth ----> [Pi] (RaspAP + OMV5)
|                      |
WiFi 1              WiFi 2 (subnet)

Follow these steps to create this configuration:

Follow RaspAP's Quick start guide and set up your network as you wish.
Change the default Web server port to
```
8080
```
(so that it doesn't conflict with OMV5), from RaspAP's System > Advanced panel.
Install OMV5 skipping network configuration.
Configure your OMV5 install without changing the network settings.
To make your OMV5 drives accessible from the subnet (WiFi 2), add the following settings at the end of OMV Control panel > Menu > SMB/CIFS > Settings Tab > Extra Options:

Code TEXT :

bind interfaces only = yes
interfaces = lo eth0

Source: openmediavault forums.

Yes, RaspAP is compatibile with Speedify's connection bonding. In this scenario, you may want to combine several internet connections (for example, a DSL connection, 4G cellphone and an LTE router) and share these via RaspAP.

Begin by running Speedify's one step install, login with your credentials and connect Speedify. Next, configure Speedify for WiFi sharing by editing the following file:

Code TEXT :

sudo nano /etc/speedify/speedify.conf

Make sure to uncomment the following lines (remove the "

" symbol). To share over the Wi-Fi interface

wlan0

, set:

Code TEXT :

ENABLE_SHARE=1
SHARE_INTERFACE="wlan0"
WIFI_INTERFACE="wlan0"

Once you have configured the sharing settings, save the file (if you are using nano, use Ctrl+O and press Enter to save). Exit the text editor and then execute:

Code TEXT :

sudo service speedify-sharing restart

Refer to Speedify's support article for additional tips and troubleshooting.

How do I serve custom pages from RaspAP?

Several users have asked if they can extend RaspAP or otherwise serve their own custom directory with the existing

lighttpd

web service. Broadly, there are two approaches to achieve this. In the examples below, we will add support for a custom directory called "admin".

Option 1. Create a subdirectory of RaspAP's default install location (

/var/www/html

) called "admin":

/var/www/html/admin

. Now, modify RaspAP's application routing rules by adding this directory to the exclusion list. You may do this with

sudo nano /etc/lighttpd/conf-available/50-raspap-router.conf

. Next, modify the following line like so:

Code TEXT :

$HTTP["url"] =~ "^/(?!(dist|app|ajax|config|admin)).*" {

Note that "admin" is appended above "config", above. This instructs lighttpd not to rewrite URLs that match this pattern. Reload the lighttpd service with

sudo systemctl reload lighttpd.service

.

You may now create your own

index.php

file in this folder and request it from the browser as

http://10.3.141.1/admin/

http://raspberrypi.local/admin

.

Option 2. Reinstall RaspAP and specify a custom install destination, for example

/var/www/html/raspap

. This will leave the default web root free for you to create any files you wish, without attempting to rewrite the URLs (the installer will only apply routing rules to your custom RaspAP root).

Can I automatically update RaspAP's adblock lists?

RaspAP's adblock feature uses several blocklists that are aggregated and updated daily. In a typical setup, you may use the Ad blocking management page to manually update these lists. Alternatively, this user-contributed script will automatically fetch the latest blocklists on the schedule of your choosing (for example, daily, weekly, etc.) and reload

dnsmasq

Code TEXT :

#!/bin/sh
#
sleep $(shuf -i 0-3600 -n1)
curl -L https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts > /etc/raspap/adblock/hostnames.tmp
curl -L https://big.oisd.nl/dnsmasq > /etc/raspap/adblock/domains.tmp
 
mv /etc/raspap/adblock/hostnames.tmp /etc/raspap/adblock/hostnames.txt
mv /etc/raspap/adblock/domains.tmp /etc/raspap/adblock/domains.txt
chown root:www-data /etc/raspap/adblock/hostnames.txt
chown root:www-data /etc/raspap/adblock/domains.txt
 
sudo systemctl reload dnsmasq.service

Credit to DanielLester83.

OpenVPN fails to start and/or I have no internet.

RaspAP supports OpenVPN clients by uploading a valid

.ovpn

file to

/etc/openvpn/client

and, optionally, creating a

login.conf

file with your client auth credentials. Additionally, in line with the project's default configuration, the following iptables rules are added to forward traffic from OpenVPN's

tun0

interface to your configured wireless interface (

wlan0

is the default):

Code TEXT :

-A FORWARD -i tun0 -o wlan0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i wlan0 -o tun0 -j ACCEPT

After starting the OpenVPN service, you may check and validate these rules like so:

Code TEXT :

$ sudo iptables -L FORWARD -v -n
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target     prot opt in     out     source               destination
1955 1493K ACCEPT     all  --  tun0   wlan0   0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED
1715  194K ACCEPT     all  --  wlan0  tun0    0.0.0.0/0            0.0.0.0/0

It is your responsibility to provide a valid

.ovpn

file. RaspAP does not attempt to validate the settings or RSA keys contained in this file. If OpenVPN fails to start, check for errors with

sudo systemctl status openvpn-client@client

and

journalctl --identifier openvpn

OpenVPN works but I have partial or no internet access.

Issues like this are frequently reported. Begin by confirming the status of your connection:

Code TEXT :

$ sudo systemctl status openvpn-client@client
● openvpn-client@client.service - OpenVPN tunnel for client
Loaded: loaded (/lib/systemd/system/openvpn-client@.service; enabled; vendor preset: enabled)
Active: active (running) since Fri 2020-06-12 15:45:41 CDT; 1min 39s ago
Docs: man:openvpn(8)
https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage
https://community.openvpn.net/openvpn/wiki/HOWTO
Main PID: 2689 (openvpn)
Status: "Initialization Sequence Completed"
Tasks: 1 (limit: 2200)
Memory: 1.1M
CGroup: /system.slice/system-openvpn\x2dclient.slice/openvpn-client@client.service
└─2689 /usr/sbin/openvpn --suppress-timestamps --nobind --config client.conf

You can also use

journalctl --identifier openvpn

to identify any errors. If your internet access is intermittent or otherwise degraded with the

openvpn-client

active, the next step is to test your connection for packet loss and latency. There are many Linux tools you can use to diagnose your network.

mtr

is a good choice as it combines functionality of the traceroute and ping programs. Install and use it to perform your own evaluation:

Code TEXT :

sudo apt install mtr -y
sudo mtr -rwc 50 -i 0.2 -rw duckduckgo.com
 
Start: 2021-06-13T11:42:26+0100
HOST: raspberrypi                                Loss%   Snt   Last   Avg  Best  Wrst StDev
1.|-- 192.168.1.254                              0.0%    50   26.8  27.1  26.5  31.4   0.8
2.|-- somerouter.net                            88.0%    50   392.0 390.4 362.1 596.7  1.2

The results are reported as round-trip response times in milliseconds and the percentage of packet loss. If you see loss and/or latency like the above example, report it to your VPN provider or find another one. Read this for more on interpreting mtr results.

Protip: free VPNs are frequently oversubscribed and usually not worth the trouble.

OpenVPN is enabled but I am still blocked from country restricted websites.

Remote hosts use a variety of methods to defeat VPNs, some more aggressively than others. Many VPN providers will advise you to configure custom DNS servers to mitigate DNS leaks, which you can do from RaspAP's DHCP > Advanced tab. Others have specific VPN nodes to use with popular streaming services.

Several users have reported that Firefox's DNS-over-HTTPS (DoH) has created problems with their VPN, in effect creating a DNS leak from the browser that circumvents RaspAP's DNS settings. Be sure to disable this "feature" when using a VPN service.

If you suspect network traffic is not being routed through tun0 (or any other interface) for some reason, you can monitor this directly from your RPi with

iftop

Code TEXT :

sudo apt install iftop
sudo iftop -i [interface]

Uploading my WireGuard config results in "MIME type not allowed".

For security reasons, your OpenVPN or WireGuard

.conf

files must have a Linux MIME type of

text/plain

. Windows ignores MIME types, relying instead on extensions. To avoid errors, be sure your file has a

text/plain

MIME type embedded in it before uploading.

Most OpenVPN and WireGuard service providers give you the option of downloading a file formatted for Linux. Alternatively, you may convert your Windows config file for use with Linux with

dos2unix

or one of several online tools made for this purpose.

I think my traffic isn't being routed through the WireGuard VPN. Can I debug this?

There are several things you can do to troubleshoot this. First, with the WireGuard service active, verify your public IPv4 address and check the external link, as shown below:

Next, you may check the WireGuard service status by executing

sudo systemctl status wg-quick@wg0.service

from the shell, like so:

Code TEXT :

$ sudo systemctl status wg-quick@wg0.service
● wg-quick@wg0.service - WireGuard via wg-quick(8) for wg0
Loaded: loaded (/lib/systemd/system/wg-quick@.service; enabled; vendor preset: enabled)
Active: active (exited) since Wed 2021-12-29 15:31:03 GMT; 1 day 18h ago
Docs: man:wg-quick(8)
man:wg(8)
https://www.wireguard.com/
https://www.wireguard.com/quickstart/
https://git.zx2c4.com/wireguard-tools/about/src/man/wg-quick.8
https://git.zx2c4.com/wireguard-tools/about/src/man/wg.8
Main PID: 1450 (code=exited, status=0/SUCCESS)
Tasks: 0 (limit: 1438)
CPU: 0
CGroup: /system.slice/system-wg\x2dquick.slice/wg-quick@wg0.service

You may also use RaspAP's built-in WireGuard logging facility. On the WireGuard > Logging tab, enable the "Display WireGuard debug log" option and choose Save settings. Check the log output in the tab and look for any errors.

Tip

The debug log facility queries the

systemd

journal with a one-time execution of

journalctl --identifier wg-quick

. If you want to update this log output, simply enable the option again. You may also execute this command directly from the shell, if you wish.

Finally, you may check and verify the WireGuard config itself, including PostUp / PostDown rules, by executing

sudo cat /etc/wireguard/wg0.conf

.

As a last piece of advice, be sure to test more than one client device connection with your WireGuard-enabled AP. Some users have reported traffic not routing as expected with one device, while a different device behaves normally.

Please note that RaspAP provides a front-end to the WireGuard service only. It has no way of validating your WireGuard configuration. For this reason, bug reports such as "WireGuard not working" won't be considered.

How can I clear RaspAP's WireGuard log?

WireGuard doesn't do any logging by default. The quasi-logging done by RaspAP executes

sudo journalctl --identifier wg-quick

. The Linux journal is not something you usually clear by yourself, however you can use journalctl's self maintenance to retain only the past two days:

Code TEXT :

sudo journalctl --vacuum-time=2d

See

man journalctl

for more information.

Why can't I access wireless mode 'N' (802.11n)?

On the Configure hotspot > Security tab, be sure to select CCMP for the Encryption Type. Save the settings and restart the hotspot. The wireless mode should be reported on clients as 802.11b/g/n.

Code TEXT :

RaspAP:
PHY Mode:     802.11n
Channel:      1
Network Type:     Infrastructure
Security:     WPA2 Personal
Signal / Noise:   -49 dBm / -86 dBm
Transmit Rate:    73

If using TKIP for encryption with WPA, you will be restricted to 54 Mb/s. This is because the IEEE 802.11n draft prohibits using high throughput with WEP or TKIP ciphers.

How do I exclude NAT rules from IP traffic on localhost?

RaspAP's Quick Installer configures network-address-translation (NAT) with iptables rules, so that the RPi can act as an internet gateway to multiple hosts on a local network with a single public IP address. This is done by rewriting the addresses of IP packets as they pass through the NAT system. Many access points, including RaspAP, use a combination of IP forwarding and masquerading to achieve this.

In some cases, NAT rules applied to

localhost

can interfere with other services running on an RPi. An example is the Plex Media Server, which has an API that listens on localhost. As of this writing, the Plex API has been built to not authenticate communication between service processes of the server. This can cause a failure to communicate with the Plex API or similar add-on services on your RPi.

The solution is to add a NAT rule ahead of the rule RaspAP installs to not apply NAT to connections destined to 127.0.0.0/8:

Code TEXT :

$ sudo iptables -t nat -I POSTROUTING -d 127.0.0.0/8 -j ACCEPT

The resulting iptables chain should look something like this:

Code TEXT :

$ sudo iptables -t nat -L -n -v
Chain PREROUTING (policy ACCEPT 31 packets, 4810 bytes)
pkts bytes target prot opt in out source destination
 
Chain INPUT (policy ACCEPT 31 packets, 4810 bytes)
pkts bytes target prot opt in out source destination
 
Chain OUTPUT (policy ACCEPT 23 packets, 1338 bytes)
pkts bytes target prot opt in out source destination
 
Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
17 999 ACCEPT all -- * * 0.0.0.0/0 127.0.0.0/8
2422 158K MASQUERADE all -- * * 0.0.0.0/0 0.0.0.0/0

Refer to this issue.

RaspAP is capable of detecting the frequencies (channels) supported by each of your device's wireless interfaces. If an interface is selected that is not capable of broadcasting on the 5 GHz band, the associated channels and the Save settings button are disabled. Next to the Wireless Mode selector, a tooltip will provide a brief explanation.

[Image]

In this case, selecting a compatible 2.4 GHz wireless mode will populate the list of available channels for that interface. Alternatively, select another interface or connect a 5 GHz capable external wireless adapter. RaspAP will automatically detect the adapter and add it to the list of available interfaces.

Why is the maximum throughput of my 802.11n AP reduced by half?

In order to achieve optimal throughput with 802.11n, the wireless stream must operate at a 40 MHz wide channel on the 2.4 GHz band. A 20 MHz channel will restrict you to 72 Mbps. Your

hostapd.conf

might have the required settings, but this is no guarantee of a 40 MHz channel.

In practice, this can be quite difficult due to interference on the 2.4 GHz band. There are many things that will cause an AP to fallback to 20 MHz. The most common reason is if an AP detects another wireless network within 40 MHz, i.e. two channels, of its own channel. For example, if an AP is set to channel 6, another network operating anywhere from channel 4 to 8 will trigger a fallback. hostapd will usually report a fallback like so:

Code TEXT :

20/40 MHz operation not permitted on channel pri=3 sec=7 based on overlapping BSSes

For more information on optimizing 802.11n, refer to this resource.

Generally speaking, the 5 GHz band has substantially greater capacity due to more non-overlapping radio channels and less radio interference as compared to the 2.4 GHz band.

Can I connect the WiFi client to a WEP network?

Wired Equivalent Privacy (WEP) has been deprecated for quite awhile but old routers still exist in the wild. Not all routers accept hex passwords, but you can try converting an ASCII password using an online tool like this one. A valid WEP key should be 5 or 13 characters or a 10- or 26-digit hexadecimal value. Be sure the hex values are unpadded and there are no trailing spaces. For example,

52617370415069734772656174

is a valid hex passphrase.

Paste your converted hex value into RaspAP's WiFi client passphrase field and try connecting.

If you're not able to connect with a hex passphrase, you can also try this alternate manual configuration method.

Can I turn the hotspot on/off over SSH?

Yes, RaspAP provides a front-end to several Linux

systemd

services, including

hostapd

. From the terminal, check the status of the

hostapd.service

like so:

Code TEXT :

$ sudo systemctl status hostapd.service
● hostapd.service - Access point and authentication server for Wi-Fi and Ethernet
Loaded: loaded (/lib/systemd/system/hostapd.service; enabled; vendor preset: enabled)

Stop the service with

sudo systemctl stop hostapd.service

and start it with

sudo systemctl start hostapd.service

.

If you're curious about which other services and Linux tools RaspAP controls for you, take a look at

raspap.sudoers

How do I upgrade RaspAP?

Upgrading an existing install without changing your configuration is very straightforward. To upgrade to the latest release version, simply run the Quick Installer with the

--upgrade

option:

Code TEXT :

curl -sL https://install.raspap.com | bash -s -- --upgrade

The installer upgrade is idempotent, meaning it can be repeated an arbitrary number of times and the result will be as if it had been done only once. If you choose this method, you're done! Confirm the upgrade by checking the release version on the About page.

If you want to install a specific version you can do so by referencing a tag:

Code TEXT :

sudo git fetch --tags
sudo git checkout 2.5

A tag is a pointer that isn't connected to the main development tree that git knows about. As a result, git will reply that you're in a 'detached HEAD' state. This isn't a big deal, it just means that you have a specific version of the code that isn't connected to the git tree.

Alternatively, if you want the latest bleeding edge commits from the master branch, use the following:

Code TEXT :

sudo git checkout -b master
sudo git pull origin master

If you've customized your installation by editing

config.php

, update the release version in this file:

Code TEXT :

sudo nano /var/www/html/includes/config.php

Change the first line to the release version, save the file and exit.

Note

RASPI_VERSION

is only used on the About page; it does not affect any other functionality.

Code TEXT :

define('RASPI_VERSION', '2.8.9');

Finally, give the lighttpd service a kick with:

Code TEXT :

sudo systemctl restart lighttpd.service

Whichever method you choose (installer upgrade, specific release or latest updates), your RaspAP configuration won't be changed.

Do I need the RaspAP service to run at boot?

If you are using your RPi as a client on a WiFi network (also known as managed mode) and hosting an access point simultaneously, the

raspapd.service

will ensure that your hotspot is active after a reboot. It does this by detecting WiFi client AP mode, adding the

uap0

interface and starting up networking services in a specific order.

If your RPi is configured with wired ethernet (

eth0

) or you haven't experienced problems with the AP starting on boot, you can disable the RaspAP daemon like so:

Code TEXT :

sudo systemctl disable raspapd.service

Can the Quick Installer accept the default options without prompting me?

Yes, the Quick Installer has a non-interactive mode that lets you perform unattended setups. This mode assumes "yes" as an answer to all prompts. You can do an unattended install of RaspAP by appending the

--yes

command-line option, like so:

Code TEXT :

curl -sL https://install.raspap.com | bash -s -- --yes

The options

-y

--assume-yes

are also accepted and have the same result.

How do I uninstall RaspAP?

We have provided an uninstall script to remove RaspAP cleanly, and also restore any backups of your configuration that were created before RaspAP was installed. The uninstall script is located in

installers/uninstall.sh

. To start the uninstaller, simply run the following from the project root folder (default location is

/var/www/html

Code TEXT :

cd /var/www/html
sudo installers/uninstall.sh

Insiders

Sun, 08 Nov 2026 14:23:29 +0100

{: style="width:640px"}

Development of RaspAP is made possible thanks to a sponsorware release model. This means that new features are first exclusively released to sponsors as part of Insiders. Read on to learn what sponsorships achieve, how to become a sponsor and what's in it for you!

!!! success "Paying it forward" We donate a percentage of all proceeds from Insiders to the Raspberry Pi Foundation each quarter, to help inspire future generations of makers together with their educators.

What is Insiders?

RaspAP Insiders is a private fork of RaspAP, hosted as a private GitHub repository. Almost all new features are developed as part of this fork, which means that they are immediately available to all eligible sponsors, as they are made collaborators of this repository.

Every feature is tied to a funding goal in monthly subscriptions. When a funding goal is hit, the features that are tied to it are merged back into the RaspAP public repo and released for general availability, making them available to all users. Bugfixes are always released in tandem.

Sponsorships start as low as $10 per month.

What sponsorships achieve

Sponsorships make this project sustainable, as they buy the maintainers of this project time — a very scarce resource – which is spent on the development of new features, bug fixes, stability improvement, issue triage and community support.

If you're unsure if you should sponsor this project, check out the list of completed funding goals to learn whether you're already using features that were developed with the help of sponsorships. You're most likely using at least a handful of them, thanks to our awesome sponsors!

What's in it for me?

The moment you become a sponsor, you'll get immediate access to the additional features below that you can start using right away, and which are currently exclusively available to sponsors:

:octicons-check-circle-fill-24:{: .check } Network device management
:octicons-check-circle-fill-24:{: .check } Firewall settings
:octicons-check-circle-fill-24:{: .check } WPA3-Personal AP security
:octicons-check-circle-fill-24:{: .check } 802.11w Protected Management Frames
:octicons-check-circle-fill-24:{: .check } Printable Wi-Fi signs
:octicons-check-circle-fill-24:{: .check } Drag & drop dashboard widgets
:octicons-check-circle-fill-24:{: .check } MAC address cloning
:octicons-check-circle-fill-24:{: .check } Network diagnostics
:octicons-check-circle-fill-24:{: .check } WireGuard kill switch
:octicons-check-circle-fill-24:{: .check } Dynamic DNS
:octicons-check-circle-fill-24:{: .check } Multiple WireGuard configs

A tangible side benefit of sponsorship is that Insiders are able to help steer future development of RaspAP. This is done through Insiders' access to discussions, feature requests, issues and pull requests in the private GitHub repository.

Look for the list above to grow as we add more exclusive features. Be sure to visit this page from time to time to learn about what's new, or follow @RaspAP on :fontawesome-brands-twitter:{: .twitter } Twitter to stay updated.

Thanks for your interest in sponsoring! You can become a sponsor using your individual or organization's GitHub account. Just pick any tier from $10/month and complete the checkout. You will be automatically granted access to the private GitHub repository containing the Insiders edition, which has all exclusive features. In addition, you will be added as a team member with access to Insiders-only team discussions and content.

Join our awesome sponsors :octicons-heart-fill-24:{ .md-button .md-button--primary }

!!! info "Info" If you're sponsoring RaspAP through a GitHub organization, please send a short email to sponsors@raspap.com with the name of your organization and the account that should be added as a collaborator.[^2]

You can cancel your sponsorship anytime.[^3]

Funding targets

Below is a list of funding targets. When a funding target is reached, the features that are tied to it are merged back into RaspAP and released to the public for general availability.

Goals

The following section lists all funding goals. Each goal contains a list of features prefixed with a checkmark symbol, denoting whether a feature is :octicons-check-circle-fill-24:{: .check } already available or :octicons-check-circle-fill-24:{ style="color: var(--md-default-fg-color--light)" } planned, but not yet implemented. When the funding goal is hit, the features are released for general availability.

$1,000 - 2nd Insiders Edition

:octicons-check-circle-fill-24:{: .check } Network device management
:octicons-check-circle-fill-24:{: .check } Firewall settings
:octicons-check-circle-fill-24:{: .check } WPA3-Personal AP security
:octicons-check-circle-fill-24:{: .check } 802.11w Protected Management Frames
:octicons-check-circle-fill-24:{: .check } Printable Wi-Fi signs
:octicons-check-circle-fill-24:{: .check } Drag & drop dashboard widgets
:octicons-check-circle-fill-24:{: .check } MAC address cloning
:octicons-check-circle-fill-24:{: .check } Network diagnostics

$1,500 - 3rd Insiders Edition

:octicons-check-circle-fill-24:{: .check } WireGuard kill switch
:octicons-check-circle-fill-24:{: .check } Dynamic DNS
:octicons-check-circle-fill-24:{: .check } Multiple WireGuard configs

Completed goals

$500 - 1st Insiders Edition

:octicons-check-circle-fill-24:{: .check } Multiple OpenVPN client configs
:octicons-check-circle-fill-24:{: .check } OpenVPN certificate authentication
:octicons-check-circle-fill-24:{: .check } OpenVPN service logging
:octicons-check-circle-fill-24:{: .check } Night mode toggle
:octicons-check-circle-fill-24:{: .check } Restrict network to static clients
:octicons-check-circle-fill-24:{: .check } WireGuard support
:octicons-check-circle-fill-24:{: .check } Set AP transmit power

Transparency

We've chosen OpenCollective as the fiscal host for our GitHub sponsors organization. This means that our budget is completely transparent — financial contributions, expenses and payouts to project team members are automatically reported. Everyone can see where money comes from and what it's spent on. This committent to full transparency was central in our decision to implement Insiders.

Quarterly giving

Beginning in 2022, each quarter 15% of all proceeds from Insiders will be donated directly to the Raspberry Pi Foundation. The Raspberry Pi Foundation is a UK-based charity that works to put the power of computing and digital making into the hands of people all over the world.

https://www.youtube.com/embed/dEzg92g1LHw

The Foundation supports initiatives like Coder Dojo, Astro Pi, Coolest Projects and much more.

When you become an Insider, not only do you support development of RaspAP but you also help inspire young people by harnessing the power of computing to solve problems and express themselves creatively.

Support for educators

We are big believers in the role that computing and digital technologies can play in shaping a better world. Many engineers, including members of the RaspAP team, got their first introduction to computing at an early age. This can take the form of a structured curriculum in a school setting, or less-formally through clubs, competitions and partnerships with youth organizations. Equally important is university, vocational and research training in digital technologies at all levels.

To this end, we have pledged to make Insiders freely available to all educators, their students, club participants and staff.

Criteria

Educators, teacher trainers, researchers and club organizers engaged in digital and computing technologies for students of all ages are eligible. The only requirement is a GitHub account and a domain email address associated with an educational institution or organization with a focus on digital learning. Send a mail to sponsors@raspap.com with your GitHub account details and we'll get you started with Insiders.

Frequently asked questions

Installing

How do I install Insiders?

Invoke the Quick Installer with the

--insiders

switch, like so:

Code TEXT :

curl -sL https://install.raspap.com | bash -s -- --insiders

!!! tip "Tip" During the Insiders install, GitHub will ask you for your username and password in order to clone the private repository. You must enter a GitHub Personal Access Token at the password prompt. This is explained in the Authentication section below.

Alternatively, you may skip the GitHub authentication step by specifying your GitHub credentials with the

--name

and

--token

parameters:

Code TEXT :

curl -sL https://install.raspap.com | bash -s -- --insiders --name [username] --token [my-token]

Upgrading

I have an existing RaspAP installation. How do I upgrade to Insiders?

Upgrading is easy. Simply invoke the Quick Installer with the

--upgrade

switch, specifying the private Insiders option, like so:

Code TEXT :

curl -sL https://install.raspap.com | bash -s -- --upgrade --insiders

!!! tip "Tip" When upgrading to Insiders, GitHub will ask you for your username and password in order to clone the private repository. You must enter a GitHub Personal Access Token at the password prompt. This is explained in the Authentication section below.

As with a fresh Insiders install, you may also skip the GitHub authentication step by specifying your GitHub credentials with the

--name

and

--token

parameters:

Code TEXT :

curl -sL https://install.raspap.com | bash -s -- --upgrade --insiders --name [username] --token [my-token]

Authentication

As of August 2021 GitHub removed support for password authentication, so you will need to generate a Personal Access Token and use this in place of your password. The process of creating a token is straightforward and described here.

!!! tip "Tip" Before invoking the Quick installer to perform an upgrade or new Insiders install, it's recommended to verify your token using the method described below.

If this is your first time using a GitHub personal access token, you can verify it by using

curl

and the GitHub API. Substitute your token value for

MY_TOKEN

below:

Code TEXT :

curl -sS -f -I -H "Authorization: token MY_TOKEN" https://api.github.com

If successful, GitHub should reply with

HTTP/2 200

and a

x-oauth-scopes: repo

value in the response. If you receive a

HTTP 401

or other error from curl, check your token and try again.

You will be asked to authenticate with GitHub when the installer clones the private Insiders repo. In this case, simply enter your GitHub username and token when prompted.

!!! note "Note" Your token is sent securely via SSH to GitHub. The installer does not have access to or store your token.

If you're using GitHub with 2FA enabled the same process above applies.

Terms

We're using RaspAP for a commercial project. Can we use Insiders under the same terms and conditions?

Yes. Whether you're an individual or a company, you may use RaspAP Insiders precisely under the same terms as RaspAP, which are defined by the GNU GPL 3.0 license. However, we kindly ask you to respect the following guidelines:

Please don't distribute the source code of Insiders. You may freely use it for public, private or commercial projects, fork it, mirror it, do whatever you want with it, but please don't release the source code, as it would counteract the sponsorware strategy.
If you cancel your subscription, you're removed as a collaborator and will miss out on future updates of Insiders. However, you may use the latest version that's available to you as long as you like. Just remember that GitHub deletes private forks.

[^1]: You may be wondering if the sponsorware model contradicts the ethos of Open Source software. It's true that some features are locked behind a payment, which means they are only accessible after pledging a small amount of money. However, these features are only exclusive until specific funding targets are reached. Making an Open Source project sustainable is exceptionally difficult. Maintainers invest significant time and energy developing software, testing, responding to issues, writing documentation and so on. Too often, this leads to burnout and abandoned projects. The sponsorware model ensures that if you decide to use RaspAP, you can be sure that the project remains healthy, bugs are fixed quickly and new features are added regularly.

[^2]: It's currently not possible to grant access to each member of an organization, as GitHub only allows for adding users. Thus, after sponsoring, please send an email to sponsors@raspap.com, stating which account should become a collaborator of the Insiders repository. We're working on a solution which will make access to organizations much simpler.

[^3]: If you cancel your sponsorship, GitHub schedules a cancellation request which will become effective at the end of the billing cycle, which ends at the 22^nd^ of the month for monthly sponsorships. This means that even though you cancel your sponsorship, you will keep your access to Insiders as long as your cancellation isn't effective. All charges are processed by GitHub through Stripe. As we don't receive any information regarding your payment, and GitHub doesn't offer refunds, sponsorships are non-refundable.

Softcloud Wiki

RaspAP Documentation Pages

Overview

Ad blocking

Access point settings

Basics

Connecting clients

802.11ac 5 GHz

Security settings

WPA3-Personal

Experimental · Insiders only

802.11w

Experimental · Insiders only

Drag & drop widgets

Experimental · Insiders only

Printable signs

Experimental · Insiders only

Advanced options

Bridged AP mode

WiFi client AP mode

Beacon interval

Disable disassoc_low_ack

Transmit power

Maximum number of clients

Troubleshooting

Debug log

Diagnosing problems

Reverting to base settings

Accessing backups

AP-STA mode

Overview Experimental (Unsupported)

What is AP-STA mode?

Use cases

How does AP-STA work?

Installation

When to reboot?

Changing hostapd settings

Bridged AP mode

Overview

Toggling bridged AP mode

Limitations

Accessing the web interface

Troubleshooting

Default settings

Overview

Configuration directory

Managing config values

Networking defaults

DNS servers

VPN providers

Restoring settings

Dynamic DNS

Overview Experimental · Insiders only

Solution

Installation

Basic settings

Service provider

Method to obtain IP

Login and domain

Advanced settings

Enable SSL

Daemon check interval

Troubleshooting

Port forwarding

Demilitarized zone

Discussions

FAQ

General

Troubleshooting

Integrations

OpenVPN

WireGuard

Networking

Install & upgrade

Why isn't there support for Desktop distributions?

What do all these settings in the UI do? Changing them seems to have no effect.

How do I prepare the SD card to connect to WiFi in headless mode?

Can I use wlan0 and wlan1 rather than eth0 for my AP?

Can I use RaspAP as a monitor only, without changing my configuration?

Can I use RaspAP with my custom dnsmasq configuration?