# lnxrouter: one script to turn Linux into a NAT gateway with WiFi hotspot support > lnxrouter is a single bash script that configures Linux as a router by wrapping iptables, dnsmasq and hostapd. It handles Internet sharing, WiFi hotspots, IPv6, transparent proxying, and routing for containers and VMs, and restores the system state on exit. **garywill/linux-router** — Set Linux as router in one command. Support Internet sharing, redsocks, Wifi hotspot, IPv6. Can also be used for routing VM/containers 🛰️ - Repository: https://github.com/garywill/linux-router - Stars: 2,057 · Forks: 182 - Language: Shell - License: LGPL-2.1 - Published: 2026-10-11 · Updated: 2026-10-11 · Language: en - Canonical page: https://hysenlabs.com/projects/garywill-linux-router ## One script wrapping iptables, dnsmasq and hostapd to create a sub-network Setting up Linux as a router by hand means configuring iptables for NAT, running dnsmasq for DHCP and DNS, and optionally starting hostapd for a WiFi access point. Each of those steps requires knowing the right flags, the correct order of operations, and how to undo them cleanly. lnxrouter does that configuration in a single command and undoes it the same way: press ctrl-c, run a stop command, or simply close the terminal window. The project is a one-file bash script that wraps iptables, dnsmasq and related tools. When it runs, it creates a NATed sub-network on the interface you specify. Clients on that sub-network get addresses from a built-in DHCP server, resolve names through a built-in DNS server, and route their traffic through the host. That covers the basic gateway case: one interface provides the Internet and another serves clients. The manual alternative to this script is configuring iptables rules and a dnsmasq instance by hand, keeping track of which rules are temporary and which are permanent. lnxrouter removes that bookkeeping by managing everything in process. When the script exits, the rules exit with it. Instances can also be run in parallel to create multiple independent sub-networks on the same host. ## Download and run without a package manager lnxrouter is not packaged for any Linux distribution. The install method is to download the raw script and run it directly. Anyone who wants to package it for a distro can open a pull request to add a link to the README. The core dependencies are bash, procps or procps-ng, iproute2, dnsmasq, and iptables. Systems with nftables can substitute iptables-nft as a translation layer. For WiFi hotspot functionality, hostapd is required, along with iw or, when iw does not recognize the adapter, iwconfig. haveged, crda and wireless-regdb are listed as optional. The most basic routing setup, sharing Internet to an Ethernet interface, is: ```bash sudo lnxrouter -i eth1 ``` This works regardless of which other interface the host uses to receive Internet, according to the README section headed 'Provide Internet to an interface'. A second usage section, headed 'Provide an interface's Internet to another interface', shows how to add the `-o` flag when clients should access Internet through one specific named interface. The README's note for this case calls for stopping local DNS service and telling clients which DNS server to use instead: ```bash sudo lnxrouter -i eth1 -o isp5 --no-dns --dhcp-dns 1.1.1.1 -6 --dhcp-dns6 [2606:4700:4700::1111] ``` Creating a LAN with no Internet access at all uses the -n flag: `sudo lnxrouter -n -i eth1`. ## WiFi hotspot creates a virtual interface named x0wlan0, not wlan0 directly Creating a WiFi access point takes the `--ap` flag with the wireless interface, the SSID and the passphrase: ```bash sudo lnxrouter --ap wlan0 MyAccessPoint -p MyPassPhrase ``` This works even when wlan0 is the same interface the host uses to get Internet. To make that possible, lnxrouter creates a virtual interface for the access point rather than using the original interface directly. The specific detail worth noting: when you pass wlan0, the virtual interface for the hotspot is named x0wlan0. Any diagnostic or monitoring command that checks wlan0 directly will see the upstream connection, not the access point traffic. The hotspot feature covers WiFi 3, 4, 5 and 6, operates on both 2.4GHz and 5GHz bands, and allows channel selection. Encryption options include WPA2/WPA combined mode, WPA2 alone, WPA alone, or no encryption. Creating an access point on the same physical interface that provides Internet upstream is listed in the features, but the README adds a specific constraint inline: it needs hardware support, and usually requires both connections to be on the same channel. This matters in practice because it limits which frequency band or channel the hotspot can use, and not all hardware supports the mode at all. The channel constraint applies only to the same-interface scenario; a separate physical interface for the hotspot does not have this restriction. ## Transparent proxy routes all client traffic through a local port The `--tp` flag routes all client TCP traffic to a local port on the host, which is what a transparent proxy like redsocks expects. Combining it with `--dns` redirects DNS queries to a separate local port: ```bash sudo lnxrouter -i eth1 --tp 9040 --dns 9053 -g 192.168.55.1 -6 --p6 fd00:5:6:7:: ``` The torrc configuration that matches this command sets TransPort to 192.168.55.1:9040 and DNSPort to 192.168.55.1:9053, with parallel IPv6 entries for [fd00:5:6:7::1]. The transparent proxy example in the README uses Tor, and it includes a direct disclaimer: routing traffic through Tor this way does not provide anonymity. The project is explicit that lnxrouter does not aim at anonymity. A separate sandbox mode adds flags for client isolation: ```bash sudo lnxrouter -i eth1 \ --tp 9040 --dns 9053 \ --random-mac \ --ban-priv \ --catch-dns --log-dns ``` The `--random-mac` flag randomizes the MAC address of the routing interface. `--ban-priv` blocks client access to private address ranges on the host. `--catch-dns` intercepts port 53 packets and redirects them. These flags together create a configuration where clients can reach the Internet but the host and the local network are not reachable from clients. ## Routing LXC, LXD, VirtualBox and firejail through bridged interfaces lnxrouter accepts any network interface for its `-i` flag, including bridges. For LXC, the approach is to create a bridge and pass it to lnxrouter: ```bash sudo brctl addbr lxcbr5 sudo lnxrouter -i lxcbr5 ``` The LXC container's config file then points its network interface at that bridge using lxc.network.link = lxcbr5. The container gets its address from lnxrouter's DHCP server and routes through the host. LXD uses a profile instead of a config file. The README walks through creating a profile that adds a bridged eth0 pointing at lxdbr5, applied to a container with lxc profile add. Combining the LXD profile with the transparent proxy mode routes all container traffic through a local proxy port. The LXD setup also shows using lxc profile remove and lxc config device add/remove as alternatives, giving two paths to attach and detach the network configuration. VirtualBox uses a host-only network with its built-in DHCP disabled, then lnxrouter runs against that interface. firejail uses the same bridge approach as LXC, with an additional step: DNS must be passed explicitly to firejail's --dns flag because firejail does not obtain DNS from DHCP on the bridge. ## Interference detection for NetworkManager and firewalld Two common Linux system daemons actively interfere with what lnxrouter does: NetworkManager and firewalld. NetworkManager takes control of network interfaces it recognizes, which can conflict with lnxrouter's configuration of those same interfaces. lnxrouter handles this by managing the interface's managed status, switching it to unmanaged before configuring it and restoring the original status on exit. firewalld enforces its own iptables or nftables rules on top of whatever lnxrouter sets. lnxrouter's response is to place the interface in firewalld's trusted zone temporarily. Trusted zones in firewalld accept all traffic, so the zone assignment overrides the blocking rules that firewalld would otherwise apply. Both daemon names are listed explicitly in the feature section under "Detect and prevent interference." Neither behavior is configurable from the README's documented options. If a system uses a different firewall manager or a different network daemon, the interference detection may not apply, and the README does not describe what to do in that case. ## What lnxrouter does not do: no persistence, no distro packages, no anonymity lnxrouter produces no persistent configuration. When the script exits, the routing, NAT, and DHCP configuration disappears. Running it at boot requires a separate wrapper or init script that is not included in the repository. The run-and-restore design keeps setup simple but also means the tool is not a replacement for a system network daemon. No Linux distribution currently packages lnxrouter. The install method is always a manual download of the raw script. No checksum or signature verification method is documented. Anonymity is explicitly disclaimed. The transparent proxy section includes a warning that routing traffic through Tor this way does not provide anonymity, because Tor's anonymity depends on a purpose-built browser. The project adds that it does not aim at anonymity at all. For client isolation, the sandbox mode with --ban-priv and --random-mac is the closest lnxrouter comes to a hardened configuration, but that is network isolation, not anonymity. Version 0.8.2 was released on 2026-07-08, and it is distributed under LGPL-2.1. The repository root contains three files: the lnxrouter script, README.md, and a text file containing the LGPL-2.1 terms. ## Conclusion lnxrouter fits any Linux host where you need a temporary NAT gateway without installing a dedicated routing daemon. It works well for Internet sharing in a single command, for routing VM and container traffic through a bridge, and for creating a WiFi hotspot on hardware that supports it. Skip it when you need a configuration that survives reboots without a wrapper, a distro package, or any anonymity guarantee for routed traffic. Before relying on it for WiFi, confirm that hostapd supports your adapter and check whether your hardware allows AP mode on the same channel as your upstream connection. ## FAQ ### What does lnxrouter do? lnxrouter turns a Linux host into a NAT router or WiFi hotspot by wrapping iptables, dnsmasq and hostapd in a single bash script. It creates a NATed sub-network, serves DHCP and DNS to clients, and restores the original network state when it exits. ### How do I install lnxrouter? lnxrouter is a single-file script with no distro packages. Download the raw file named lnxrouter from the repository and run it with sudo. Dependencies include bash, iproute2, dnsmasq and iptables; for WiFi hotspot, hostapd is also required. ### Can I use lnxrouter to create a WiFi hotspot on Linux? Yes. The command sudo lnxrouter --ap wlan0 MyAccessPoint -p MyPassPhrase creates a hotspot on wlan0. lnxrouter creates a virtual interface named x0wlan0 for the access point, so the original wlan0 can still be used for the upstream Internet connection. ### Does lnxrouter work with containers and virtual machines? Yes. Create a bridge interface for the container or VM, attach the container to it, and run sudo lnxrouter -i with the bridge name. The README gives step-by-step examples for LXC, LXD, VirtualBox and firejail. ### Is lnxrouter safe to use for anonymous browsing? No. The README explicitly states that lnxrouter does not ensure and does not aim at anonymity. Using it to route traffic through Tor does not provide Tor's anonymity guarantees, which depend on a purpose-built browser. ## Sources - [garywill/linux-router on GitHub](https://github.com/garywill/linux-router) - [Issues](https://github.com/garywill/linux-router/issues) - [License: LGPL-2.1](https://github.com/garywill/linux-router/blob/master/LICENSE) - [README](https://github.com/garywill/linux-router/blob/master/README.md) - [Releases](https://github.com/garywill/linux-router/releases) --- Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/garywill-linux-router