Creating a Secure Wi-Fi Hotspot on Ubuntu

An Ubuntu laptop can share its internet connection with a phone, tablet, streaming device, or another computer. This is useful when a home router is unavailable, an NBN connection is down, or you need to get online while travelling between Sydney, Melbourne, Brisbane, or regional Australia. Ubuntu’s NetworkManager handles the essential work, including DHCP, routing, and wireless encryption.

A hotspot is only as secure as its settings and the network supplying the connection. A strong passphrase, WPA2 or WPA3 encryption, current software, and sensible firewall rules help prevent unwanted access. It is also important to remember that a hotspot shares the laptop’s internet connection; it does not automatically make an unsafe public network private.

Check The Connection And Wireless Hardware

Before creating a hotspot, connect the Ubuntu computer to the internet through Ethernet, Wi-Fi, or a compatible USB modem. NetworkManager normally shares whichever connection is currently active. Ethernet is often the most reliable option, especially if the laptop is being used at home with an NBN modem or router. A wired upstream connection also leaves the Wi-Fi adapter free to serve other devices.

A single wireless adapter may be unable to receive Wi-Fi and broadcast a hotspot at the same time. Many modern adapters support this combined mode, but some do not. You can check the device and its capabilities with:

nmcli device status
iw list

Look through the iw list output for an entry mentioning AP under supported interface modes. If it is absent, use Ethernet, USB tethering, or a second USB Wi-Fi adapter. Hardware sold for the Australian market should generally operate with the local regulatory settings, but avoid forcing unusual channels or transmit power. The 2.4 GHz band usually reaches further through walls, while 5 GHz can be faster and less congested in busy areas such as apartment buildings in Melbourne or Sydney.

Install updates before relying on the hotspot. Wireless firmware and NetworkManager fixes often arrive through normal Ubuntu updates:

sudo apt update
sudo apt upgrade

Restarting after a kernel or firmware update can ensure the new driver is active. Also check that the laptop is plugged in or has enough battery. Sharing a connection keeps the wireless radio, processor, and sometimes a USB modem active, which can drain a battery quickly during a long train trip or an outage.

Create A Hotspot From Ubuntu Settings

The simplest method uses the Ubuntu desktop. Open Settings, select Wi-Fi, and open the Wi-Fi options menu. Choose Turn On Wi-Fi Hotspot. Ubuntu should create a network name, display the password, and begin advertising the connection. The exact labels can vary between Ubuntu releases and desktop environments, but the relevant options are usually under Wi-Fi or Network settings.

Open the hotspot details and replace the automatically generated network name if necessary. Avoid using your full name, address, phone number, or vehicle registration as the SSID. A neutral name such as Laptop-Share reveals less about the owner. Set a long password containing several unrelated words, numbers, and symbols. A passphrase of at least 14 characters is easier to remember and substantially stronger than a short word with one digit added.

Ubuntu generally creates a WPA-protected hotspot through NetworkManager. Check the security field before sharing the password. WPA2-Personal is broadly compatible with Android phones, iPhones, smart TVs, and older laptops. WPA3-Personal offers improved protection on newer hardware, but forcing WPA3 can prevent older devices from connecting. If Ubuntu only presents a WPA2 option, use it with a strong unique passphrase rather than weakening the password for convenience.

Do not publish the password on a noticeboard or leave it visible in a café. If you are sharing the connection temporarily with a visitor, give them the password directly and change it afterwards. This is particularly sensible when using a laptop in a public library, hotel, university, or airport, where unknown people may be close enough to attempt to join.

Configure Sharing With Nmcli

The command-line tool nmcli is useful when the desktop interface does not expose all hotspot settings or when you are working on Ubuntu Server. First identify the wireless interface:

nmcli device status

A name such as wlp2s0 usually identifies the Wi-Fi adapter. Replace it in the following command if your system uses a different name:

nmcli device wifi hotspot \
  ifname wlp2s0 \
  con-name Ubuntu-Secure-Hotspot \
  ssid Ubuntu-Share \
  password 'use-a-long-unique-passphrase'

NetworkManager creates a connection profile, assigns a private address range, and enables connection sharing. It normally uses WPA2-Personal for compatibility. The profile can be inspected with:

nmcli connection show Ubuntu-Secure-Hotspot

For a more explicit configuration, set the connection to shared IPv4 mode and confirm the security type:

nmcli connection modify Ubuntu-Secure-Hotspot \
  ipv4.method shared \
  802-11-wireless-security.key-mgmt wpa-psk

The password can be changed without recreating the network:

nmcli connection modify Ubuntu-Secure-Hotspot \
  802-11-wireless-security.psk 'another-long-unique-passphrase'
nmcli connection down Ubuntu-Secure-Hotspot
nmcli connection up Ubuntu-Secure-Hotspot

Keep the password out of shell history when privacy matters. Commands containing credentials may be recorded in the terminal history file, and other local users could potentially read connection profiles. For a one-off hotspot, the graphical interface may be preferable. When using nmcli, quote passwords containing spaces or shell characters so that the command is interpreted correctly.

Strengthen Wireless And System Security

Use a different hotspot password from your Ubuntu login, email, banking, and Australian ISP accounts. Reusing a password means that someone who learns the hotspot key could gain access to unrelated services. A password manager can generate and store a random key, although a long memorable phrase is practical when several family members need to type it into their devices.

Avoid WEP, open networks, and legacy WPA security. An open hotspot allows nearby devices to connect without authentication, and WEP can be broken with readily available tools. WPA2 with AES, shown in NetworkManager as WPA-PSK or WPA2-Personal, remains a sensible choice for mixed devices. WPA3 is preferable where every client supports it and Ubuntu exposes the option reliably.

Turn off automatic reconnection for sensitive clients when appropriate. Phones and laptops may remember a network and connect to it whenever they see the same SSID later. A malicious person could imitate that name. Use a distinctive SSID and remove the saved profile from devices that no longer need access. On Ubuntu, saved profiles can be listed and deleted with:

nmcli connection show
nmcli connection delete "Ubuntu-Secure-Hotspot"

Keep Ubuntu’s firewall enabled and limit services that listen on the laptop. A basic UFW policy can block unsolicited connections to the host while allowing normal outbound traffic:

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw enable
sudo ufw status verbose

Firewall behaviour around forwarded hotspot traffic can vary with NetworkManager and Ubuntu versions, so test the clients after enabling it. Do not assume that a firewall makes shared devices invisible to one another. Stop file sharing, remote desktop, development servers, and temporary web servers while the hotspot is active.

Manage Connected Devices And Data Use

A shared connection normally uses Network Address Translation, DHCP, and a private subnet. This lets connected devices reach the internet without exposing their private addresses to the upstream network. It does not prevent a connected device from probing services on the Ubuntu laptop or, depending on the configuration, other devices on the hotspot.

Review connected devices while the hotspot is running:

nmcli device wifi list
nmcli connection show --active

The graphical Wi-Fi panel may also show connected clients, depending on the Ubuntu release and desktop. If an unfamiliar device appears, stop the hotspot, change the password, and start it again. Changing the SSID as well can help prevent a previously configured device from reconnecting automatically.

Be careful with the amount of data being shared. Australian mobile plans from providers such as Telstra, Optus, and Vodafone can have different tethering rules, speed limits, and data allowances. A laptop update, cloud backup, streaming service, or game download may consume several gigabytes quickly. If your upstream connection is mobile broadband, pause automatic updates and synchronisation, and set client devices to metered mode where available.

Some upstream providers or networks block tethering, restrict inbound traffic, or use carrier-grade NAT. That usually does not stop ordinary web browsing, but it can affect peer-to-peer applications, remote access, and some games. A hotspot also cannot guarantee privacy on a hotel, café, or public Wi-Fi connection. Use HTTPS, trusted VPN software where appropriate, and avoid entering sensitive information on networks you do not control.

Test The Hotspot And Shut It Down

Connect one test device first rather than handing the password to everyone immediately. Confirm that it receives an IP address, can resolve domain names, and can browse several HTTPS websites. Test both the upstream connection and local behaviour. If the client connects but has no internet access, check that Ubuntu itself is online and that the active connection is configured for sharing rather than a manually assigned IPv4 method.

Useful diagnostic commands include:

nmcli general status
nmcli device show wlp2s0
journalctl -u NetworkManager --since "10 minutes ago"

Replace wlp2s0 with the actual interface name. Logs may reveal a driver failure, unsupported access-point mode, authentication error, or conflict with another saved connection. If devices cannot see the hotspot, try moving closer, switching between 2.4 GHz and 5 GHz where the interface permits it, or testing without Bluetooth activity nearby. Crowded wireless conditions are common in dense Brisbane, Perth, and Adelaide suburbs.

When finished, stop sharing rather than leaving the hotspot active. In the desktop interface, disable the hotspot or Wi-Fi. With nmcli, use:

nmcli connection down Ubuntu-Secure-Hotspot

You can also prevent automatic activation by modifying the profile:

nmcli connection modify Ubuntu-Secure-Hotspot connection.autoconnect no

Delete the profile if the hotspot was created for a single event. This removes the saved wireless credentials from NetworkManager, though connected phones or laptops may still retain the network and password in their own saved profiles. Remove it from those devices as well when using a borrowed computer or a shared family tablet.

A secure Ubuntu hotspot begins with supported hardware and a trusted upstream connection, then relies on WPA2 or WPA3, a unique long passphrase, current software, and careful control of connected clients. Remember that the hotspot password protects entry to the shared network, while Ubuntu updates, a restrained firewall, and good habits protect the laptop and the data passing through it.