Wi-Fi Client and Hotspot on One Radio: What Breaks

Your phone stays connected to the hotspot while the uplink passes nothing. The Pi still reports a Wi-Fi association, the access point still beacons, and every request times out. A single radio is serving two roles at once, and one of them wins when the other needs the channel. Before touching the VPN, establish whether the installed driver and firmware accept that role pairing at all.

The Symptom Points at the Radio, Not the Tunnel

Watch the failure in order and it stops looking like a routing bug. A client joins the hotspot, gets an address, and loads a page or two. Then the station interface reassociates with the upstream router after a roam, a rekey, or a brief signal dip. The access point either restarts its beacon or leaves its clients without a path, and the VPN log fills with reconnect attempts that were never the cause.

Two interface names do not make two radios. wlan0 and the access point interface share one device, one channel state machine and one firmware scheduler. The kernel exposes exactly which role and channel combinations that device supports, so read that list instead of assuming the pairing works because both interfaces came up.

Read the Combination Before You Change Anything

The wireless stack reports its own contract in the interface combination section of iw list. Each numbered combination lists permitted role counts, how many interfaces may exist, and how many different channels those interfaces may occupy at the same time. A combination that names one station and one access point on a single channel is the one this deployment needs.

iw list | sed -n '/valid interface combinations/,/^$/p'

Read the numbers rather than the presence of the words. A driver can support station mode and access point mode separately, while the only legal combination of both allows a single channel, a small interface total, or a beacon interval the hotspot cannot meet. Some firmwares also drop one role during a scan or a rekey, which looks like a flapping uplink rather than a capability limit. If no combination lists both roles, the pairing is unsupported, whatever the desktop's hotspot button suggests.

The cfg80211 interface combination documentation describes the fields and the beacon constraint. Values from one adapter say nothing about another, so keep the output with the machine rather than generalising it.

Channel and Address Plan Decide the Rest

An access point has to sit on a channel the radio can serve, and a station uplink has to follow the upstream access point. When those two decisions disagree, one role must restart. On many single-radio adapters the hotspot therefore mirrors the station channel, and an upstream channel change briefly takes the hotspot down with it.

Plan the IP side separately from the radio. A routed hotspot commonly uses a private subnet such as 192.168.50.0/24 with the Pi at 192.168.50.1, a DHCP pool inside that subnet, and the Pi as resolver forwarder. NetworkManager's shared mode sets up forwarding and address translation for that subnet, but it does not add radio capacity or make the tunnel the only exit. Write down whether clients are bridged at layer two or routed at layer three before you argue about VPN policy.

Test Order That Separates Radio From Routing

Work outward from the device and stop at the first step that fails. These reads are safe on a live system and change no configuration. Run them while a client is associated and the uplink is in the state you are debugging.

iw dev
iw dev wlan0 link
nmcli -t -f DEVICE,STATE,CONNECTION device status
ip -br addr show
sysctl net.ipv4.ip_forward

If iw dev wlan0 link shows no association, the radio problem comes first and the tunnel is irrelevant. If the uplink is associated and the client has no address, the attachment and DHCP authority are wrong. If the client has an address but no reachability, forwarding, translation or resolver delivery is missing. Only when both the hotspot path and the uplink path work does a failing tunnel become the next thing to test.

Record the adapter, driver and firmware alongside the accepted combination and channel rule. A later kernel or firmware update can change the supported list, and that note is what turns a mystery into a known limitation.