# Wireless (WLAN/WiFi) Interfaces in VyOS

> Configure wireless WLAN/WiFi interfaces in VyOS: Access Point and Station modes, WPA2/WPA3 encryption, channel selection and regulatory domains

Source: https://opennix.org/en/docs/vyos/interfaces/vyos-wlan/


Wireless interfaces in VyOS let you create access points (Access Point) or connect to existing wireless networks (Station mode).

## Overview

VyOS supports the following wireless interface operating modes:

- **Access Point (WAP)** - provide wireless access to client devices
- **Station (Client)** - connect to an existing wireless network
- **Monitor** - passively monitor wireless traffic

**Supported standards**:
- IEEE 802.11a (5 GHz)
- IEEE 802.11b/g (2.4 GHz)
- IEEE 802.11n (2.4/5 GHz)
- IEEE 802.11ac (5 GHz)
- IEEE 802.11ax (2.4/5/6 GHz, WiFi 6)

**Security**:
- WPA/WPA2-Personal (PSK)
- WPA3-Personal (SAE)
- WPA/WPA2-Enterprise (802.1X RADIUS)
- Management Frame Protection (IEEE 802.11w)

## Regulatory domain

**IMPORTANT**: Before configuring wireless interfaces, you must set the country code (regulatory domain).

### Setting the country code

```
set system wireless country-code ru
commit
```

Country codes (ISO 3166-1 alpha-2):
- `ru` - Russia
- `us` - United States
- `de` - Germany
- `gb` - United Kingdom
- `fr` - France
- `jp` - Japan
- `cn` - China

The country code determines:
- Allowed frequencies and channels
- Maximum transmit power
- DFS (Dynamic Frequency Selection) requirements
- Allowed standards (802.11d)

## Access Point mode

### Basic configuration

A simple access point with WPA2:

```
set system wireless country-code ru
set interfaces wireless wlan0 type access-point
set interfaces wireless wlan0 address 192.168.10.1/24
set interfaces wireless wlan0 ssid 'MyNetwork'
set interfaces wireless wlan0 channel 6
set interfaces wireless wlan0 security wpa mode wpa2
set interfaces wireless wlan0 security wpa cipher CCMP
set interfaces wireless wlan0 security wpa passphrase 'SecurePassword123'
commit
```

### SSID

Setting the network name:

```
set interfaces wireless wlan0 ssid 'Office-WiFi'
commit
```

**Parameters**:
- Maximum length: 32 characters
- May contain spaces (use quotes)
- UTF-8 encoding is supported

Hidden SSID (not advertised in beacons):

```
set interfaces wireless wlan0 security wpa disable-ssid-broadcast
commit
```

### Channel selection

2.4 GHz (802.11b/g/n):

```
set interfaces wireless wlan0 channel 1
commit
```

Available 2.4 GHz channels:
- `1-14` (depending on the regulatory domain)
- Recommended non-overlapping: 1, 6, 11

5 GHz (802.11a/n/ac/ax):

```
set interfaces wireless wlan0 channel 36
commit
```

Available 5 GHz channels:
- `36, 40, 44, 48` - UNII-1 (indoor)
- `52, 56, 60, 64` - UNII-2 (indoor, requires DFS)
- `100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140, 144` - UNII-2 Extended (requires DFS)
- `149, 153, 157, 161, 165` - UNII-3 (outdoor)

6 GHz (802.11ax, WiFi 6E):

```
set interfaces wireless wlan0 channel 1
commit
```

6 GHz channels: `1-233`

Automatic channel selection (ACS):

```
set interfaces wireless wlan0 channel 0
commit
```

### Wireless standard

802.11b (2.4 GHz, up to 11 Mbps):

```
set interfaces wireless wlan0 physical-device phy0
set interfaces wireless wlan0 mode b
commit
```

802.11g (2.4 GHz, up to 54 Mbps):

```
set interfaces wireless wlan0 mode g
commit
```

802.11n (2.4/5 GHz, up to 600 Mbps):

```
set interfaces wireless wlan0 mode n
commit
```

802.11ac (5 GHz, up to 6.9 Gbps):

```
set interfaces wireless wlan0 mode ac
commit
```

802.11ax (2.4/5/6 GHz, WiFi 6):

```
set interfaces wireless wlan0 mode ax
commit
```

Mixed mode (b/g):

```
set interfaces wireless wlan0 mode g
commit
```

### Channel width

20 MHz (default):

```
set interfaces wireless wlan0 channel-width 20
commit
```

40 MHz (802.11n):

```
set interfaces wireless wlan0 channel-width 40
commit
```

80 MHz (802.11ac):

```
set interfaces wireless wlan0 channel-width 80
commit
```

160 MHz (802.11ac/ax):

```
set interfaces wireless wlan0 channel-width 160
commit
```

### Transmit power

Reducing power (in dBm):

```
set interfaces wireless wlan0 reduce-transmit-power 5
commit
```

The value specifies how many dBm to reduce power from the maximum allowed by the regulatory domain.

### Client isolation

Preventing direct communication between wireless clients:

```
set interfaces wireless wlan0 isolate-stations
commit
```

Useful for guest networks and public WiFi.

### Maximum Stations

Limiting the number of simultaneous connections:

```
set interfaces wireless wlan0 max-stations 50
commit
```

### MAC filtering

Allowed MAC addresses:

```
set interfaces wireless wlan0 security station-address 00:11:22:33:44:55
set interfaces wireless wlan0 security station-address aa:bb:cc:dd:ee:ff
commit
```

MAC filtering mode:

```
set interfaces wireless wlan0 security mac-mode allow
commit
```

Modes:
- `allow` - allow only the listed MACs
- `deny` - deny the listed MACs

## Station mode (client)

### Connecting to a WPA2 network

Basic client configuration:

```
set system wireless country-code ru
set interfaces wireless wlan0 type station
set interfaces wireless wlan0 address dhcp
set interfaces wireless wlan0 ssid 'ExistingNetwork'
set interfaces wireless wlan0 security wpa passphrase 'NetworkPassword'
commit
```

### Static IP address

```
set interfaces wireless wlan0 type station
set interfaces wireless wlan0 address 192.168.1.100/24
set interfaces wireless wlan0 ssid 'Office-WiFi'
set interfaces wireless wlan0 security wpa passphrase 'SecurePass123'
commit
```

### Multiple addresses

```
set interfaces wireless wlan0 address 192.168.1.100/24
set interfaces wireless wlan0 address 2001:db8::100/64
commit
```

## WPA security

### WPA2-Personal (PSK)

Recommended configuration:

```
set interfaces wireless wlan0 security wpa mode wpa2
set interfaces wireless wlan0 security wpa cipher CCMP
set interfaces wireless wlan0 security wpa passphrase 'StrongPassword123!'
commit
```

**Parameters**:
- `mode` - WPA version (wpa, wpa2, wpa3, both)
- `cipher` - encryption (CCMP, TKIP, CCMP+TKIP)
- `passphrase` - password (8-63 characters)

### WPA3-Personal (SAE)

The most secure option:

```
set interfaces wireless wlan0 security wpa mode wpa3
set interfaces wireless wlan0 security wpa cipher CCMP
set interfaces wireless wlan0 security wpa passphrase 'VeryStrongPassword123!'
commit
```

WPA3 provides:
- Protection against offline dictionary attacks
- Forward secrecy
- Stronger encryption

### WPA2/WPA3 Mixed Mode

Compatibility with older devices:

```
set interfaces wireless wlan0 security wpa mode both
set interfaces wireless wlan0 security wpa cipher CCMP
set interfaces wireless wlan0 security wpa passphrase 'SecurePassword123'
commit
```

### Management Frame Protection

Protecting management frames (IEEE 802.11w):

```
set interfaces wireless wlan0 security wpa mgmt-frame-protection required
commit
```

Modes:
- `disabled` - disabled
- `optional` - optional (default for WPA2)
- `required` - required (default for WPA3)

### WPA2-Enterprise (802.1X)

Authentication via a RADIUS server:

```
set interfaces wireless wlan0 security wpa mode wpa2
set interfaces wireless wlan0 security wpa cipher CCMP
set interfaces wireless wlan0 security wpa radius server 192.168.1.10 key 'RadiusSecret'
set interfaces wireless wlan0 security wpa radius server 192.168.1.10 port 1812
commit
```

Backup RADIUS server:

```
set interfaces wireless wlan0 security wpa radius server 192.168.1.11 key 'RadiusSecret'
set interfaces wireless wlan0 security wpa radius server 192.168.1.11 port 1812
commit
```

RADIUS accounting:

```
set interfaces wireless wlan0 security wpa radius accounting-server 192.168.1.10 key 'RadiusSecret'
set interfaces wireless wlan0 security wpa radius accounting-server 192.168.1.10 port 1813
commit
```

## VLAN support

### VLAN sub-interfaces

Creating VLAN interfaces:

```
set interfaces wireless wlan0 vif 10 address 192.168.10.1/24
set interfaces wireless wlan0 vif 10 description 'Guest WiFi'

set interfaces wireless wlan0 vif 20 address 192.168.20.1/24
set interfaces wireless wlan0 vif 20 description 'Corporate WiFi'

commit
```

### Dynamic VLAN (802.1X)

The RADIUS server assigns a VLAN based on the credentials:

```
set interfaces wireless wlan0 security wpa mode wpa2
set interfaces wireless wlan0 security wpa radius server 192.168.1.10 key 'RadiusSecret'
set interfaces wireless wlan0 security wpa dynamic-vlan
commit
```

RADIUS attributes for Dynamic VLAN:
- `Tunnel-Type = VLAN`
- `Tunnel-Medium-Type = IEEE-802`
- `Tunnel-Private-Group-Id = <VLAN-ID>`

## Multiple SSIDs

Creating several virtual wireless interfaces:

```
# Primary SSID
set interfaces wireless wlan0 type access-point
set interfaces wireless wlan0 ssid 'Corporate'
set interfaces wireless wlan0 address 192.168.10.1/24
set interfaces wireless wlan0 channel 36
set interfaces wireless wlan0 security wpa mode wpa2
set interfaces wireless wlan0 security wpa passphrase 'CorpPassword'

# Guest SSID (virtual interface)
set interfaces wireless wlan0-1 type access-point
set interfaces wireless wlan0-1 ssid 'Guest'
set interfaces wireless wlan0-1 address 192.168.20.1/24
set interfaces wireless wlan0-1 isolate-stations
set interfaces wireless wlan0-1 security wpa mode wpa2
set interfaces wireless wlan0-1 security wpa passphrase 'GuestPassword'

commit
```

## Advanced parameters

### Beacon interval

Interval for sending beacon frames (in milliseconds):

```
set interfaces wireless wlan0 beacon-interval 100
commit
```

Default: 100 ms. Range: 15-65535.

### DTIM period

Delivery Traffic Indication Message:

```
set interfaces wireless wlan0 dtim-period 2
commit
```

Determines how often to send buffered multicast/broadcast traffic to sleeping clients.

### RTS/CTS threshold

Request to Send / Clear to Send for collision avoidance:

```
set interfaces wireless wlan0 rts-threshold 2347
commit
```

Values:
- `0` - disabled
- `1-2347` - packet size in bytes at which RTS/CTS is triggered

### Fragmentation threshold

Packet fragmentation threshold:

```
set interfaces wireless wlan0 fragmentation-threshold 2346
commit
```

Packets larger than the specified size will be fragmented.

### Short preamble

Short preamble (802.11b/g only):

```
set interfaces wireless wlan0 short-preamble
commit
```

Can improve performance with devices that support it.

### WMM (WiFi Multimedia)

QoS for wireless networks:

```
set interfaces wireless wlan0 wmm
commit
```

Prioritizes voice, video, best-effort, and background traffic.

## Configuration examples

### Home WiFi access point

```
set system wireless country-code ru

set interfaces wireless wlan0 type access-point
set interfaces wireless wlan0 address 192.168.1.1/24
set interfaces wireless wlan0 ssid 'HomeNetwork'
set interfaces wireless wlan0 channel 6
set interfaces wireless wlan0 mode n
set interfaces wireless wlan0 channel-width 40

set interfaces wireless wlan0 security wpa mode wpa2
set interfaces wireless wlan0 security wpa cipher CCMP
set interfaces wireless wlan0 security wpa passphrase 'MyHomePassword123'

commit
```

### Corporate access point with RADIUS

```
set system wireless country-code ru

set interfaces wireless wlan0 type access-point
set interfaces wireless wlan0 address 10.0.10.1/24
set interfaces wireless wlan0 ssid 'Corp-Enterprise'
set interfaces wireless wlan0 channel 36
set interfaces wireless wlan0 mode ac
set interfaces wireless wlan0 channel-width 80

set interfaces wireless wlan0 security wpa mode wpa2
set interfaces wireless wlan0 security wpa cipher CCMP
set interfaces wireless wlan0 security wpa radius server 10.0.0.100 key 'RadiusSharedSecret'
set interfaces wireless wlan0 security wpa radius server 10.0.0.101 key 'RadiusSharedSecret'
set interfaces wireless wlan0 security wpa mgmt-frame-protection required

commit
```

### Guest WiFi with isolation

```
set system wireless country-code ru

set interfaces wireless wlan0 type access-point
set interfaces wireless wlan0 address 172.16.100.1/24
set interfaces wireless wlan0 ssid 'Guest-WiFi'
set interfaces wireless wlan0 channel 11
set interfaces wireless wlan0 mode n

set interfaces wireless wlan0 isolate-stations
set interfaces wireless wlan0 max-stations 100

set interfaces wireless wlan0 security wpa mode wpa2
set interfaces wireless wlan0 security wpa cipher CCMP
set interfaces wireless wlan0 security wpa passphrase 'GuestAccess2024'

commit
```

### Dual-band access point

2.4 GHz:

```
set interfaces wireless wlan0 type access-point
set interfaces wireless wlan0 address 192.168.10.1/24
set interfaces wireless wlan0 ssid 'MyNetwork-2.4G'
set interfaces wireless wlan0 channel 6
set interfaces wireless wlan0 mode n
set interfaces wireless wlan0 security wpa mode wpa2
set interfaces wireless wlan0 security wpa cipher CCMP
set interfaces wireless wlan0 security wpa passphrase 'Password123'
commit
```

5 GHz:

```
set interfaces wireless wlan1 type access-point
set interfaces wireless wlan1 address 192.168.11.1/24
set interfaces wireless wlan1 ssid 'MyNetwork-5G'
set interfaces wireless wlan1 channel 36
set interfaces wireless wlan1 mode ac
set interfaces wireless wlan1 channel-width 80
set interfaces wireless wlan1 security wpa mode wpa2
set interfaces wireless wlan1 security wpa cipher CCMP
set interfaces wireless wlan1 security wpa passphrase 'Password123'
commit
```

### WiFi client with a backup route

```
set system wireless country-code ru

set interfaces wireless wlan0 type station
set interfaces wireless wlan0 address dhcp
set interfaces wireless wlan0 ssid 'MainNetwork'
set interfaces wireless wlan0 security wpa passphrase 'MainPassword'
set interfaces wireless wlan0 dhcp-options default-route-distance 10

commit
```

### Captive Portal integration

```
set system wireless country-code ru

set interfaces wireless wlan0 type access-point
set interfaces wireless wlan0 address 10.99.0.1/24
set interfaces wireless wlan0 ssid 'Public-WiFi'
set interfaces wireless wlan0 channel 6

# Open network (no WPA)
# Authentication via web portal

set service dns forwarding listen-address 10.99.0.1

# Redirect to the captive portal
set nat destination rule 100 inbound-interface name wlan0
set nat destination rule 100 protocol tcp
set nat destination rule 100 destination port 80
set nat destination rule 100 translation address 10.99.0.1
set nat destination rule 100 translation port 8080

commit
```

### WiFi bridge for network extension

```
# Connect to an existing WiFi
set interfaces wireless wlan0 type station
set interfaces wireless wlan0 ssid 'MainRouter'
set interfaces wireless wlan0 security wpa passphrase 'MainPassword'

# Create a bridge with Ethernet
set interfaces bridge br0 member interface wlan0
set interfaces bridge br0 member interface eth0
set interfaces bridge br0 address dhcp

commit
```

## Operational commands

### Viewing interface status

```
show interfaces wireless wlan0
```

Example output:
```
wlan0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 state UP
    link/ether 00:11:22:33:44:55 brd ff:ff:ff:ff:ff:ff
    inet 192.168.10.1/24 brd 192.168.10.255 scope global wlan0
    RX:  bytes  packets  errors  dropped  overrun  mcast
         1234567  12345   0       0        0        123
    TX:  bytes  packets  errors  dropped  carrier  collisions
         7654321  54321   0       0        0        0
```

### Wireless interface information

```
show interfaces wireless wlan0 info
```

Shows:
- SSID
- Frequency/Channel
- Mode (AP/Station)
- Signal level (for Station mode)
- Connected clients (for AP mode)

### List of connected clients

```
show interfaces wireless wlan0 station
```

Example output:
```
Station            Signal   RX Rate   TX Rate   Connected
aa:bb:cc:dd:ee:ff  -45 dBm  866 Mbps  866 Mbps  00:15:23
11:22:33:44:55:66  -52 dBm  433 Mbps  433 Mbps  01:23:45
```

### Scanning available networks

```
show interfaces wireless wlan0 scan
```

Shows:
- SSID
- BSSID
- Channel
- Signal level
- Security (WPA/WPA2/Open)

### Physical capabilities

```
show interfaces wireless wlan0 capabilities
```

Output:
- Supported standards (802.11a/b/g/n/ac/ax)
- Supported frequencies
- Maximum power
- HT/VHT capabilities

### Statistics

```
show interfaces wireless wlan0 statistics
```

### Traffic monitoring

```
monitor interfaces wireless wlan0 traffic
```

### Clearing counters

```
clear interfaces wireless wlan0 counters
```

## Troubleshooting

### WiFi interface does not come up

Check the regulatory domain:

```
show system wireless country-code
```

Set it if missing:

```
set system wireless country-code ru
commit
```

Check the status:

```
show interfaces wireless wlan0
```

Check dmesg for driver errors:

```
show log | grep wlan0
```

### Clients cannot connect

Check the SSID and channel:

```
show interfaces wireless wlan0 info
```

Check the security configuration:

```
show configuration interfaces wireless wlan0 security
```

Review the hostapd logs:

```
show log | grep hostapd
```

Make sure the channel is available in the regulatory domain:

```
show interfaces wireless wlan0 capabilities
```

### Poor performance

Check the clients' signal level:

```
show interfaces wireless wlan0 station
```

Try a different channel (check neighboring networks):

```
show interfaces wireless wlan0 scan
```

Reduce the channel width:

```
set interfaces wireless wlan0 channel-width 20
commit
```

Disable WMM if there are problems:

```
delete interfaces wireless wlan0 wmm
commit
```

### Interference

Scan available networks:

```
show interfaces wireless wlan0 scan
```

Choose a less congested channel:
- 2.4 GHz: use 1, 6, or 11
- 5 GHz: pick channels away from neighboring networks

Reduce the transmit power:

```
set interfaces wireless wlan0 reduce-transmit-power 3
commit
```

### WPA3 incompatibility

Use mixed mode:

```
set interfaces wireless wlan0 security wpa mode both
commit
```

Or switch to WPA2:

```
set interfaces wireless wlan0 security wpa mode wpa2
commit
```

### RADIUS authentication does not work

Check RADIUS server reachability:

```
ping 192.168.1.10
```

Check the shared secret:

```
show configuration interfaces wireless wlan0 security wpa radius
```

Check the logs on the RADIUS server.

Test with radtest (if available):

```
radtest user password 192.168.1.10 0 RadiusSecret
```

### Frequent client disconnects

Increase the beacon interval:

```
set interfaces wireless wlan0 beacon-interval 200
commit
```

Check for interference:

```
show interfaces wireless wlan0 scan
```

Disable power saving on the clients.

## Integration with other services

### DHCP server

```
set service dhcp-server shared-network-name WIFI subnet 192.168.10.0/24 range 0 start 192.168.10.100
set service dhcp-server shared-network-name WIFI subnet 192.168.10.0/24 range 0 stop 192.168.10.200
set service dhcp-server shared-network-name WIFI subnet 192.168.10.0/24 option default-router 192.168.10.1
set service dhcp-server shared-network-name WIFI subnet 192.168.10.0/24 option name-server 8.8.8.8

set interfaces wireless wlan0 address 192.168.10.1/24

commit
```

### DNS Forwarding

```
set service dns forwarding listen-address 192.168.10.1
set service dns forwarding allow-from 192.168.10.0/24

commit
```

### NAT (Internet access)

```
set nat source rule 100 outbound-interface name eth0
set nat source rule 100 source address 192.168.10.0/24
set nat source rule 100 translation address masquerade

commit
```

### Firewall

Restricting Guest WiFi:

```
# Allow only Internet, block the local network
set firewall ipv4 name GUEST-OUT default-action drop
set firewall ipv4 name GUEST-OUT rule 10 action accept
set firewall ipv4 name GUEST-OUT rule 10 state established
set firewall ipv4 name GUEST-OUT rule 10 state related

set firewall ipv4 name GUEST-OUT rule 20 action accept
set firewall ipv4 name GUEST-OUT rule 20 destination address !192.168.0.0/16

set firewall interface wlan0 out name GUEST-OUT

commit
```

### QoS for VoIP

```
set traffic-policy shaper WIFI-QOS bandwidth 100mbit
set traffic-policy shaper WIFI-QOS class 10 bandwidth 30%
set traffic-policy shaper WIFI-QOS class 10 priority 1
set traffic-policy shaper WIFI-QOS class 10 match VOIP ip dscp ef

set interfaces wireless wlan0 traffic-policy out WIFI-QOS

commit
```

### VLAN for multiple SSIDs

```
# Corporate SSID - VLAN 10
set interfaces wireless wlan0 type access-point
set interfaces wireless wlan0 ssid 'Corporate'
set interfaces wireless wlan0 vif 10 address 10.0.10.1/24

# Guest SSID - VLAN 20
set interfaces wireless wlan0-1 type access-point
set interfaces wireless wlan0-1 ssid 'Guest'
set interfaces wireless wlan0-1 vif 20 address 10.0.20.1/24

commit
```

## Monitoring and diagnostics

### Continuous monitoring

```
monitor interfaces wireless wlan0 traffic
```

### Capturing WiFi traffic

```
monitor traffic interface wlan0
```

With a filter:

```
monitor traffic interface wlan0 filter 'port 80 or port 443'
```

### Collecting statistics

Script for monitoring clients:

```bash
#!/bin/bash
while true; do
  clear
  echo "WiFi Clients - $(date)"
  echo "================================"
  /opt/vyatta/bin/vyatta-op-cmd-wrapper show interfaces wireless wlan0 station
  sleep 5
done
```

## Security

### Recommendations

1. **Use WPA3** if all clients support it
2. **WPA2-Enterprise** for corporate networks
3. **Isolate Guest WiFi** from the main network
4. **Disable WPS** (not supported in VyOS)
5. **Hide the SSID** for additional security
6. **MAC filtering** as an extra layer
7. **Change passwords regularly**
8. **Enable Management Frame Protection**
9. **Limit the maximum number of clients**
10. **Monitor connected devices**

### Guest network isolation

```
# Guest WiFi
set interfaces wireless wlan0 type access-point
set interfaces wireless wlan0 ssid 'Guest'
set interfaces wireless wlan0 address 172.16.99.1/24
set interfaces wireless wlan0 isolate-stations

# Firewall - Internet only
set firewall ipv4 name GUEST-TO-LAN default-action drop
set firewall zone guest from local firewall name GUEST-TO-LAN
set firewall zone guest interface wlan0

# NAT for Internet
set nat source rule 200 outbound-interface name eth0
set nat source rule 200 source address 172.16.99.0/24
set nat source rule 200 translation address masquerade

commit
```

## Performance

### Optimization for high load

```
set interfaces wireless wlan0 wmm
set interfaces wireless wlan0 max-stations 100
set interfaces wireless wlan0 beacon-interval 100
set interfaces wireless wlan0 dtim-period 1

# For 802.11ac/ax
set interfaces wireless wlan0 mode ac
set interfaces wireless wlan0 channel-width 80

commit
```

### Performance monitoring

```
show interfaces wireless wlan0 statistics
show interfaces wireless wlan0 station
```

## Best practices

1. **Channel planning**
   - Use 1, 6, 11 for 2.4 GHz
   - Avoid overlap with neighboring networks
   - 5 GHz is preferable for high performance

2. **Security**
   - WPA2 minimum, WPA3 preferred
   - Enterprise (RADIUS) for business
   - Guest network isolation

3. **Performance**
   - 5 GHz for high speed
   - 80/160 MHz channels for 802.11ac/ax
   - WMM for QoS
   - Limiting the number of clients

4. **Reliability**
   - Backup RADIUS servers
   - Monitoring connected clients
   - Event logging

5. **Documentation**
   - Description of all SSIDs
   - Coverage map
   - List of MAC addresses (if filtering is used)

6. **Regulatory compliance**
   - Correct country code
   - Compliance with transmit power limits
   - DFS for 5 GHz channels

## Limitations

- Performance depends on the WiFi adapter
- Not all adapters support AP mode
- WPA3 requires modern hardware
- DFS channels may switch when radar is detected
- The number of simultaneous SSIDs is limited by the hardware
- Monitor mode may not be supported by all adapters

## Hardware compatibility check

List of supported adapters:

```
show interfaces wireless
```

Checking capabilities:

```
show interfaces wireless wlan0 capabilities
```

Linux drivers with good AP mode support:
- ath9k (Atheros)
- ath10k (Atheros)
- iwlwifi (Intel)
- rt2800 (Ralink)
- rtl8xxxu (Realtek)

## Next steps

- [Firewall](/docs/vyos/firewall/) - protecting the wireless network
- [DHCP Server](/docs/vyos/services/vyos-dhcp/) - automatic client configuration
- [NAT](/docs/vyos/nat/) - providing Internet access
- [QoS](/docs/vyos/qos/) - traffic prioritization
- [VPN](/docs/vyos/vpn/) - secure remote access