AP_INTERFACE="wlan0" # ap
SOURCE_INTERFACE="wlan1" # to router

# Flush rules
iptables -t nat -F
iptables -F

# Apply new rules
iptables -t nat -A POSTROUTING -o $SOURCE_INTERFACE -j MASQUERADE
iptables -A FORWARD -i $SOURCE_INTERFACE -o $AP_INTERFACE -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -i $AP_INTERFACE -j ACCEPT

# Save rules
iptables-save > /etc/iptables/rules.v4 # iptables-persistent

auto lo
iface lo inet loopback

iface eth0 inet manual

allow-hotplug wlan1
iface wlan1 inet manual
  wpa-conf /etc/wpa_supplicant/wpa_supplicant.conf

allow-hotplug wlan0
iface wlan0 inet static
  address 10.10.11.1
  netmask 255.255.255.0