You need to share your connection right now
You are on a train with a single laptop running Fedora. A colleague needs to join a video call but their phone has no data. You need to share your wired or cellular connection over WiFi in under two minutes. The GNOME Settings menu sometimes hides the hotspot toggle, or it fails silently when you click it. The terminal gives you direct control over NetworkManager without guessing which GUI checkbox did what.
What is actually happening under the hood
NetworkManager treats a WiFi hotspot as a specialized connection profile. When you switch a wireless interface to access point mode, the kernel driver stops scanning for existing networks and starts broadcasting its own SSID. NetworkManager then spins up a local DHCP server, assigns IP addresses to connecting devices, and routes their traffic through your primary internet connection. The firewall automatically creates the necessary NAT rules. You are not configuring a router. You are telling the network manager to temporarily act like one.
The transition requires the wireless driver to support multiple concurrent modes. Most modern chips handle this by creating a virtual interface for the hotspot while keeping the physical interface available for other tasks. Older or budget adapters often lack this capability. They can only operate in managed client mode. NetworkManager checks the driver capabilities before allowing the mode switch. If the hardware cannot broadcast, the daemon refuses the request and logs a clear denial.
NetworkManager also handles lease management automatically. It reserves a small IP range, typically 192.168.2.0/24, and hands out addresses to devices that authenticate. The DHCP server runs as a lightweight internal process. You do not need to install dnsmasq or isc-dhcp-server. The package manager ships everything required. The configuration lives in /etc/NetworkManager/system-connections/. Files in /usr/lib/NetworkManager/ ship with the package and should never be edited. Manual edits drift. The command-line tool stays synchronized with the system state.
Check your driver capabilities before you change modes. Not every wireless chip supports broadcasting and receiving at the same time.
Create and activate the hotspot
First, identify the correct wireless interface. NetworkManager requires the exact device name to bind the hotspot profile. Run this command to list available devices and their current state.
nmcli device status
# Lists all network interfaces managed by NetworkManager
# Look for the wireless device showing 'disconnected' or 'connected'
# Note the exact name in the first column, usually wlan0 or wlp2s0
Create the hotspot profile. The nmcli connection add command writes a new configuration file to /etc/NetworkManager/system-connections/. This file survives reboots and persists across sessions.
nmcli connection add type wifi ifname wlp2s0 mode ap ssid FedoraHotspot password SecurePass123
# type wifi tells NetworkManager to use the 802.11 stack
# ifname binds the profile to your specific wireless hardware
# mode ap switches the driver from client scanning to access point broadcasting
# ssid sets the network name visible to other devices
# password sets WPA2/WPA3 encryption. Minimum 8 characters required.
Activate the profile. Creating the profile does not start the hotspot. You must bring the connection up to trigger the DHCP server and firewall rules.
nmcli connection up FedoraHotspot
# Activates the profile and starts broadcasting the SSID
# NetworkManager automatically handles DHCP lease assignment
# The command returns 'Connection successfully activated' when ready
If you need to change the password or SSID later, modify the existing profile instead of creating a duplicate. Duplicate profiles cause activation conflicts.
nmcli connection modify FedoraHotspot wifi.psk NewSecurePass456
# Updates the pre-shared key in the existing configuration file
# NetworkManager reloads the profile automatically without requiring a restart
# The change takes effect the next time a client attempts to authenticate
Run the activation command from a terminal with internet access. If your only connection is the wireless card you just switched to AP mode, you will lose connectivity until the hotspot is fully up.
Verify the connection is routing traffic
Confirm the interface is actually broadcasting and handing out addresses. Check the connection state and the assigned IP range.
nmcli connection show FedoraHotspot | grep -E 'ipv4.addresses|wifi.ssid|GENERAL.STATE'
# Filters the full profile dump to show only active state and IP assignment
# GENERAL.STATE should read 'connected'
# ipv4.addresses shows the hotspot gateway IP, typically 192.168.2.1
Connect a phone or secondary laptop to the SSID. Open a browser and load any website. If the page loads, NAT routing is working. Check the DHCP lease table to see connected clients.
nmcli device wifi list
# Shows currently broadcasting networks and connected stations
# Look for the MAC addresses of devices that joined your hotspot
# The 'CHAN' column confirms the operating frequency and channel width
Ping the gateway IP from a connected device. If you get replies but no internet, the routing table is correct but your upstream connection is blocked.
Common pitfalls and exact error messages
The most frequent failure occurs when the wireless driver lacks AP mode support. Cheap or very old adapters only support managed client mode. NetworkManager will refuse to activate the profile and print a clear error.
Error: Connection activation failed: (7) No suitable device found for this connection (device wlan0 not available because device is strictly unmanaged).
Check driver capabilities with iw list. Look for the Supported interface modes section. If AP is missing, the hardware cannot function as a hotspot. Replace the adapter or use a different machine.
Another common issue involves interface conflicts. If your wireless card is already connected to a WiFi network, NetworkManager will block the hotspot activation. You must disconnect the existing WiFi connection first.
nmcli connection down "Wired connection 1"
# Replaces your active connection name. Disconnecting frees the interface for AP mode.
# NetworkManager cannot bind two profiles to the same physical interface simultaneously
# The command returns immediately. Wait three seconds before activating the hotspot.
Password length triggers a silent GUI failure and a terminal error. WPA2 requires a minimum of eight characters. Shorter passwords cause the profile creation to abort.
Error: Connection 'FedoraHotspot' is not available on device wlp2s0 because secret is too short.
SELinux rarely blocks hotspot creation, but it will log denials if you manually edit configuration files in the wrong location. Always create profiles through nmcli. Manual edits in /etc/NetworkManager/system-connections/ require correct file permissions and SELinux contexts. The command-line tool handles this automatically. If you suspect a security policy block, check the audit logs.
journalctl -t setroubleshoot | tail -n 5
# Shows SELinux denial summaries with one-line explanations
# Look for 'avc: denied' messages related to NetworkManager or nmcli
# Read the full explanation before disabling SELinux enforcement
Run journalctl -xeu NetworkManager immediately after a failed activation. Read the last ten lines before guessing. The daemon logs the exact reason it refused the mode switch.
When to use this versus alternatives
Use nmcli when you need a persistent, scriptable hotspot that survives reboots and integrates with Fedora's firewall and routing stack. Use nmtui when you prefer a terminal-based menu interface but still want NetworkManager to handle DHCP and NAT automatically. Use the GNOME Settings hotspot toggle when you only need a temporary connection and do not care about configuration persistence. Use hostapd and dnsmasq manually when you require custom channel selection, enterprise WPA2-Enterprise authentication, or non-standard DHCP ranges. Stay on nmcli if you want zero maintenance and automatic conflict resolution.
Trust the package manager and NetworkManager defaults. Manual daemon configurations drift, nmcli profiles stay synchronized with the system state.