bruno@thinkpad:~$ dpkg -S anacron.orig.anacron
diversion by live-config from: /usr/sbin/anacron
diversion by live-config to: /usr/sbin/anacron.orig.anacron

bruno@thinkpad:~$ dpkg -l | grep live-config
ii  live-config                 5.20170112+deb9u1      all          Live System Configuration Components
ii  live-config-doc           5.20170112+deb9u1      all          Live System Configuration Components (documentation)
ii  live-config-sysvinit     5.20170112+deb9u1      all          Live System Configuration Components (sysvinit backend)

auto lo
iface lo inet loopback

auto eth0
iface eth0 inet dhcp

auto wlan0
iface wlan0 inet static
address 192.168.10.1
netmask 255.255.255.0
dns-nameservers 198.153.192.50

#!/bin/bash

# Dependencies: iproute2 iptables dnsmasq hostapd haveged
# Usage: Set the variables below, then run this script as root/sudo

ssid=GNULinuxAP
password=DevuanRocks
ip_stem=192.168.10
dns_server=8.8.8.8
channel=11

main()
{
setup_nat
setup_dnsmasq
setup_hostapd
}

setup_nat()
{
echo 1 >/proc/sys/net/ipv4/conf/eth0/forwarding
echo 1 >/proc/sys/net/ipv4/ip_forward
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
iptables -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -i wlan0 -o eth0 -j ACCEPT
}

setup_dnsmasq()
{
ifconfig wlan0 $ip_stem.1
echo "listen-address=$ip_stem.1
bind-dynamic
dhcp-range=$ip_stem.100,$ip_stem.200,255.255.255.0,24h
dhcp-option-force=option:router,$ip_stem.1
dhcp-option-force=option:dns-server,$dns_server
dhcp-option-force=option:mtu,1500
no-hosts" >/tmp/dnsmasq.conf
dnsmasq -C /tmp/dnsmasq.conf
}

setup_hostapd()
{
echo "beacon_int=100
ssid=$ssid
interface=wlan0
driver=nl80211
channel=$channel
ignore_broadcast_ssid=0
ap_isolate=0
hw_mode=g
wpa=3
wpa_passphrase=$password
wpa_key_mgmt=WPA-PSK
wpa_pairwise=TKIP CCMP
rsn_pairwise=CCMP" >/tmp/hostapd.conf 
hostapd /tmp/hostapd.conf
}

main

bruno@thinkpad:~$ sudo bash -x hotspot
+ hotspot_ssid=FreeInternet
+ hotspot_password=DevuanRules
++ route
++ wc -l
++ grep default
++ awk '{print $8}'
+ n_candidates=1
+ '[' 1 = 1 ']'
++ route
++ awk '{print $8}'
++ grep default
+ internet_if=wlan0
+ iw dev wlan0 interface add ap0 type __ap
+ ip link set dev ap0 address 5c:ac:4c:2f:93:60
+ ip link set down dev ap0
+ ip addr flush ap0
+ sleep 1
+ ip link set up dev ap0
RTNETLINK answers: Name not unique on network
+ ip addr add 192.168.20.1/24 broadcast 192.168.20.255 dev ap0
+ cat /proc/sys/net/ipv4/conf/wlan0/forwarding
+ cat /proc/sys/net/ipv4/ip_forward
+ echo 1
+ echo 1
+ modprobe nf_nat_pptp
+ iptables -w -t nat -I POSTROUTING -s 192.168.20.0/24 '!' -o ap0 -j MASQUERADE
+ iptables -w -I FORWARD -i ap0 -s 192.168.20.0/24 -j ACCEPT
+ iptables -w -I FORWARD -i wlan0 -d 192.168.20.0/24 -j ACCEPT
+ iptables -w -I INPUT -p tcp -m tcp --dport 5353 -j ACCEPT
+ iptables -w -I INPUT -p udp -m udp --dport 5353 -j ACCEPT
+ iptables -w -t nat -I PREROUTING -s 192.168.20.0/24 -d 192.168.20.1 -p tcp -m tcp --dport 53 -j REDIRECT --to-ports 5353
+ iptables -w -t nat -I PREROUTING -s 192.168.20.0/24 -d 192.168.20.1 -p udp -m udp --dport 53 -j REDIRECT --to-ports 5353
+ iptables -w -I INPUT -p udp -m udp --dport 67 -j ACCEPT
+ echo 'listen-address=192.168.20.1
bind-dynamic
dhcp-range=192.168.20.100,192.168.20.200,255.255.255.0,24h
dhcp-option-force=option:router,192.168.20.1
dhcp-option-force=option:dns-server,192.168.20.1
# If you’d like to have dnsmasq assign static IPs, bind the LAN computer'\''s
# NIC MAC address:
#dhcp-host=98:f1:70:4f:4b:67,192.168.20.60 # roku stick
dhcp-option-force=option:mtu,1500
no-hosts'
+ dnsmasq -C /tmp/dnsmasq.conf -p 5353
++ iw dev wlan0 link
++ awk '{print $2}'
++ grep -i freq
+ frequency=2462
+ '[' -z 2462 ']'
++ ieee80211_frequency_to_channel 2462
++ local FREQ=2462
++ [[ 2462 -eq 2484 ]]
++ [[ 2462 -lt 2484 ]]
++ echo 11
+ channel=11
+ echo 'beacon_int=100
ssid=FreeInternet
interface=ap0
driver=nl80211
channel=11
ignore_broadcast_ssid=0
ap_isolate=0
hw_mode=g
wpa=3
wpa_passphrase=DevuanRules
wpa_key_mgmt=WPA-PSK
wpa_pairwise=TKIP CCMP
rsn_pairwise=CCMP'
+ hostapd /tmp/hostapd.conf
Configuration file: /tmp/hostapd.conf
Could not set interface ap0 flags (UP): Name not unique on network
nl80211: Could not set interface 'ap0' UP
nl80211 driver initialization failed.
hostapd_free_hapd_data: Interface ap0 wasn't started
+ trap cleanup EXIT HUP TERM
+ cleanup
+ echo 'Cleaning up...'
Cleaning up...
+ cat /tmp/forwarding.saved
+ cat /tmp/ip_forward.saved
+ pkill hostapd
+ iptables -w -t nat -D POSTROUTING -s 192.168.20.0/24 '!' -o ap0 -j MASQUERADE
+ iptables -w -D FORWARD -i ap0 -s 192.168.20.0/24 -j ACCEPT
+ iptables -w -D FORWARD -i wlan0 -d 192.168.20.0/24 -j ACCEPT
+ iptables -w -D INPUT -p tcp -m tcp --dport 5353 -j ACCEPT
+ iptables -w -D INPUT -p udp -m udp --dport 5353 -j ACCEPT
+ iptables -w -t nat -D PREROUTING -s 192.168.20.0/24 -d 192.168.20.1 -p tcp -m tcp --dport 53 -j REDIRECT --to-ports 5353
+ iptables -w -t nat -D PREROUTING -s 192.168.20.0/24 -d 192.168.20.1 -p udp -m udp --dport 53 -j REDIRECT --to-ports 5353
+ iptables -w -D INPUT -p udp -m udp --dport 67 -j ACCEPT
+ ip link set down dev ap0
+ ip addr flush ap0
+ iw dev ap0 del

#!/bin/bash

# Dependencies: iw iproute2 iptables dnsmasq hostapd haveged
# Usage: Set the ssid and password below, then run this script as root/sudo on host machine
# Result: A virtual wireless interface is created on host to share its internet access

hotspot_ssid=GNULinuxAP
hotspot_password=gnuforever

main()
{
    shoo_network_manager
    find_internet_if
    find_wireless_if
    create_hotspot_if
    setup_nat
    setup_dnsmasq
    setup_hostapd
}

shoo_network_manager() # if network manager is running, make sure it doesn't meddle with our hostpot (we don't need its "help")
{
    if pgrep NetworkManager &>/dev/null; then # network manager is running
        nm_config_file=/etc/NetworkManager/NetworkManager.conf
        if grep -q 'interface-name:ap0' $nm_config_file; then # ap0 already mentioned in config file, so we're done
            return
        else # network manager is running and ap0 not mentioned in config file
            if grep -q 'unmanaged-devices' $nm_config_file; then # there's an unmanaged interface list already, add ap0 to it
                sed -i -r 's/(unmanaged-devices.*$)/\1;interface-name:ap0/' $nm_config_file
            else # there's no unmanaged interface list yet, so let's start one
                printf '\n[keyfile]\nunmanaged-devices=interface-name:ap0' >>$nm_config_file
            fi
        fi
    fi
}

find_internet_if() # find host's internet-facing interface
{
    n_candidates=$(route | grep default | awk '{print $8}' | wc -l)
    if [ "$n_candidates" = "1" ]; then
        internet_if=$(route | grep default | awk '{print $8}')
    else
        echo "More than one internet-facing interface found: $(route | grep default | awk '{print $8}')"
        echo -n "Which one should will feed the hotspot? "
        read internet_if
    fi
}

find_wireless_if() # find host's wireless interface
{
    wireless_if=$(cat /proc/net/wireless | perl -ne '/(\w+):/ && print $1') # e.g., wlan0 or wlp2s0
}

create_hotspot_if() # create a virtual wireless interface to use as hotspot, with arbitrary name of ap0
{
    iw dev $wireless_if interface add ap0 type __ap

    # wait up to 5 seconds for ap0 to exist
    c=0
    while true; do 
        iw dev ap0 info &>/dev/null && break
        sleep 0.5
        ((c++))
        ((c==10)) && { echo "ap0 could not be created within the time limit."; exit 1; }
    done
    sleep 1

    ip link set dev ap0 address c4:04:15:9c:07:9d # a made-up mac address with real vendor bits (c4:04:15 = Netgear) 
    ip link set down dev ap0
    ip addr flush ap0
    ip link set up dev ap0
    ip addr add 192.168.20.1/24 broadcast 192.168.20.255 dev ap0
}

setup_nat() # nat is more robust than bridge
{
    # first save current routing settings
    cat /proc/sys/net/ipv4/conf/$internet_if/forwarding >/tmp/forwarding.saved
    cat /proc/sys/net/ipv4/ip_forward >/tmp/ip_forward.saved
    
    # now go ahead and change routing/firewall settings for NAT sharing
    echo 1 >/proc/sys/net/ipv4/conf/$internet_if/forwarding
    echo 1 >/proc/sys/net/ipv4/ip_forward
    modprobe nf_nat_pptp &>/dev/null # to enable clients to establish PPTP connections
    iptables -w -t nat -I POSTROUTING -s 192.168.20.0/24 ! -o ap0 -j MASQUERADE
    iptables -w -I FORWARD -i ap0 -s 192.168.20.0/24 -j ACCEPT
    iptables -w -I FORWARD -i $internet_if -d 192.168.20.0/24 -j ACCEPT
    iptables -w -I INPUT -p tcp -m tcp --dport 5353 -j ACCEPT # for dns, can be any non-privileged port
    iptables -w -I INPUT -p udp -m udp --dport 5353 -j ACCEPT
    iptables -w -t nat -I PREROUTING -s 192.168.20.0/24 -d 192.168.20.1 -p tcp -m tcp --dport 53 -j REDIRECT --to-ports 5353
    iptables -w -t nat -I PREROUTING -s 192.168.20.0/24 -d 192.168.20.1 -p udp -m udp --dport 53 -j REDIRECT --to-ports 5353
    iptables -w -I INPUT -p udp -m udp --dport 67 -j ACCEPT
}

setup_dnsmasq() # DHCP server
{
    echo "listen-address=192.168.20.1
bind-dynamic
dhcp-range=192.168.20.100,192.168.20.200,255.255.255.0,24h
dhcp-option-force=option:router,192.168.20.1
dhcp-option-force=option:dns-server,192.168.20.1
dhcp-option-force=option:mtu,1500
no-hosts" >/tmp/dnsmasq.conf
    dnsmasq -C /tmp/dnsmasq.conf -p 5353
}

ieee80211_frequency_to_channel()
{
    local FREQ=$1
    if [[ $FREQ -eq 2484 ]]; then
        echo 14
    elif [[ $FREQ -lt 2484 ]]; then
        echo $(( ($FREQ - 2407) / 5 ))
    elif [[ $FREQ -ge 4910 && $FREQ -le 4980 ]]; then
        echo $(( ($FREQ - 4000) / 5 ))
    elif [[ $FREQ -le 45000 ]]; then
        echo $(( ($FREQ - 5000) / 5 ))
    elif [[ $FREQ -ge 58320 && $FREQ -le 64800 ]]; then
        echo $(( ($FREQ - 56160) / 2160 ))
    else
        echo 0
    fi
}

setup_hostapd()
{
    # first figure out radio frequency/channel for hotspot
    frequency=$(iw dev $wireless_if link | grep -i freq | awk '{print $2}')
    if [ -z "$frequency" ]; then # if wifi is off, use an arbitary channel (can be 1 or any other)
        channel=1
    else # if wifi is active on host, put ap0 on same channel for maximum hardware compatibility
        channel=$(ieee80211_frequency_to_channel $frequency)
    fi

    # now we have everything we need for hostapd
    echo "beacon_int=100
ssid=$hotspot_ssid
interface=ap0
driver=nl80211
channel=$channel
ignore_broadcast_ssid=0
ap_isolate=0
hw_mode=g
wpa=3
wpa_passphrase=$hotspot_password
wpa_key_mgmt=WPA-PSK
wpa_pairwise=TKIP CCMP
rsn_pairwise=CCMP" >/tmp/hostapd.conf 
    hostapd /tmp/hostapd.conf
}

cleanup()
{
    echo "Cleaning up..."
    cat /tmp/forwarding.saved >/proc/sys/net/ipv4/conf/$internet_if/forwarding
    cat /tmp/ip_forward.saved >/proc/sys/net/ipv4/ip_forward    
    pkill -f /tmp/dnsmasq.conf # kill only the dnsmasq instance we started
    pkill hostapd
    iptables -w -t nat -D POSTROUTING -s 192.168.20.0/24 ! -o ap0 -j MASQUERADE
    iptables -w -D FORWARD -i ap0 -s 192.168.20.0/24 -j ACCEPT
    iptables -w -D FORWARD -i $internet_if -d 192.168.20.0/24 -j ACCEPT
    iptables -w -D INPUT -p tcp -m tcp --dport 5353 -j ACCEPT
    iptables -w -D INPUT -p udp -m udp --dport 5353 -j ACCEPT
    iptables -w -t nat -D PREROUTING -s 192.168.20.0/24 -d 192.168.20.1 -p tcp -m tcp --dport 53 -j REDIRECT --to-ports 5353
    iptables -w -t nat -D PREROUTING -s 192.168.20.0/24 -d 192.168.20.1 -p udp -m udp --dport 53 -j REDIRECT --to-ports 5353
    iptables -w -D INPUT -p udp -m udp --dport 67 -j ACCEPT
    ip link set down dev ap0 
    ip addr flush ap0
    iw dev ap0 del
}
trap cleanup EXIT HUP TERM

main