hostapd config for Intel WiFi6 AX201 (5Ghz)

ax201-hostapd.conf

# Config for Intel WiFi6 AX201
ctrl_interface=/var/run/hostapd
ctrl_interface_group=0

logger_syslog=-1
logger_syslog_level=2
logger_stdout=-1
logger_stdout_level=1

ssid=AwesomeWifi
utf8_ssid=1

wpa_passphrase=1234567890

# use wpa2
wpa=2

# wpa-psk, wpa3 keys
wpa_key_mgmt=WPA-PSK WPA-PSK-SHA256 SAE

#wpa_pairwise=TKIP CCMP
rsn_pairwise=CCMP

# enable pre-authentication
rsn_preauth=1

# lowest supported 5Ghz channel in Finland
channel=149

country_code=FI
# advertise country code and regulatory info
ieee80211d=1

# DFS radar detection
ieee80211h=1

# spectrum management & enforce local power constraint
spectrum_mgmt_required=1
local_pwr_constraint=3

# use interface wlo1, br0 bridge to internet
interface=wlo1
bridge=br0

# default driver
driver=nl80211

# management frame protection (MFP) is enabled
ieee80211w=2

# a = 5ghz
hw_mode=a

# HT enabled
ieee80211n=1
ht_capab=[HT40+][LDPC][SHORT-GI-20][SHORT-GI-40][TX-STBC][RX-STBC1][DSSS_CCK-40][MAX-AMSDU-7935]

# enable VHT
ieee80211ac=1
# VHT channel width (1 for best compatibility)
vht_oper_chwidth=1
# freq sequence index (magic value, channel+6 or something)
vht_oper_centr_freq_seg0_idx=155
# vht capabilities (consult iw info)
vht_capab=[MAX-MPDU-11454][VHT160][RXLDPC][SHORT-GI-80][SHORT-GI-160][TX-STBC-2BY1][RX-STBC-1][SU-BEAMFORMEE][MU-BEAMFORMEE]

# enable WMM
wmm_enabled=1

# mostly default values for these
rts_threshold=-1
fragm_threshold=-1

beacon_int=100
dtim_period=2
max_num_sta=255

# isolate clients
ap_isolate=1

For anyone reading this in 2026, I've managed to get AX101 to run WIFI 6 AP. From an iPhone I get a little over 400Mb/s DL speed.

Patching hostapd was necessary to unlock channels via prescanning but after experimentation I was able to get Wifi 4, 5 and 6 AP to work. No kernel patch. Here's a complete hostapd config file with roughly minimal amount of settings necessary that works (with patched hostapd):

interface=wlo1
bridge=br-lan
driver=nl80211
ssid=TestNetwork
country_code=SE
ieee80211d=1
hw_mode=a
channel=149
auth_algs=1
wmm_enabled=1
ieee80211n=1
ht_capab=[HT40+][SHORT-GI-20][SHORT-GI-40]
require_ht=1
ieee80211ac=1
require_vht=1
vht_oper_chwidth=1
vht_oper_centr_freq_seg0_idx=155
ieee80211ax=1
require_he=1
he_oper_chwidth=1
he_oper_centr_freq_seg0_idx=155
wpa=2
sae_password=11111111
ieee80211w=2
wpa_key_mgmt=SAE

As NixOS configuration:

services.hostapd = {
  enable = true;
  radios.${wlan} = {
    # hw_mode=a + channel=149  ->  band "5g"
    band = "5g";
    channel = 149;

    countryCode = "SE";

    # ieee80211n=1 + require_ht=1 + ht_capab=[...]
    wifi4 = {
      enable = true;
      require = true;
      capabilities = [
        "HT40+"
        "SHORT-GI-20"
        "SHORT-GI-40"
      ];
    };

    # ieee80211ac=1 + require_vht=1 + vht_oper_chwidth=1
    wifi5 = {
      enable = true;
      require = true;
      operatingChannelWidth = "80";
    };

    # ieee80211ax=1 + require_he=1 + he_oper_chwidth=1
    wifi6 = {
      enable = true;
      require = true;
      operatingChannelWidth = "80";
    };

    settings = {
      vht_oper_centr_freq_seg0_idx = 155;
      he_oper_centr_freq_seg0_idx = 155;
    };

    networks.${wlan} = {
      ssid = "<SSID>";
      authentication = {
        mode = "wpa3-sae";
        saePasswords = [
          { passwordFile = "<password-file-available-in-runtime>"; }
        ];
      };
      settings.bridge = ${bridge};
    };
  };
};

plus an overlay if someone needs it:

  hostapd = prev.hostapd.overrideAttrs (
    oldAttrs:
    let
      patchName = "hostapd-intel-5ghz-no-ir";
    in
    {
      pname = patchName;

      patches = (oldAttrs.patches or [ ]) ++ [
        (final.fetchurl {
          name = "${patchName}.patch";
          url = "https://raw.githubusercontent.com/PedroFirmware/hostapd/831aff4d00a62d2dfac9bd5bb82161f09c244d34/For_intel_Wi-Fi_cards_v2_11.patch";
          hash = "sha256-AxSrkghLw4H9NAX3z/j+BTE/Nnofw2KpGNpztSoXeFM=";
        })
      ];
    }
  );

I guess U-NII-3 region is okay to use by a random Joe in most parts of the world, unfortunately other lower channels didn't unlock in my case.

IMPORTANT EDIT:

do not require vht/he (wifi5/6); it makes devices like iPhones not even consider reconnecting to the AP after they connected to some other network. Afterwards they will use VHT/HE and utilize the whole bandwidth just fine - weird quirk but maybe related to the awkward channel 149 and hitting sus code path in iOS.