+--------+         +- RPi -------------------+
| router |     (((-+ 192.168.xxx.xxx(dhcp)   |              +-Laptop-------------+
+--------+   wlan0 |     WLAN AP             |              | WLAN Client        |
                   |    192.168.50.1(static) +-)))      (((-+ 192.168.50.x(dhcp) |
                   +-------------------------+ uap0         |                    |
                                                            +--------------------+

sudo pacman -S dnsmasq hostapd dnscrypt-proxy ufw --needed

echo 'ACTION=="add", SUBSYSTEM=="ieee80211", KERNEL=="phy0", \
    RUN+="/sbin/iw phy %k interface add uap0 type __ap"' | sudo tee /etc/udev/rules.d/90-uap0.rules

echo '[Match]
Name=uap0

[Network]
Address=192.168.50.1/24' | sudo tee /etc/systemd/network/80-wifi-ap.network

sudo cp /etc/hostapd/hostapd.conf /etc/hostapd/hostapd.conf.bak

echo 'country_code=JP

interface=uap0
driver=nl80211

ssid=raspiap
# Whether to Broadcast ssid, 0 = off,1 = stealth ssid
ignore_broadcast_ssid=0
hw_mode=a
channel=36
ieee80211ac=1
# MAC Address access control, 0 = off
macaddr_acl=0
# WMM(Wi-Fi Multimedia)
wmm_enabled=1

# https://en.wikipedia.org/wiki/IEEE_802.11d-2001
ieee80211d=1
# https://en.wikipedia.org/wiki/IEEE_802.11h-2003
ieee80211h=1
# https://qiita.com/JhonnyBravo/items/5df2d9b2fcb142b6a67c
local_pwr_constraint=3
spectrum_mgmt_required=1

# Use WPA
auth_algs=1
wpa_key_mgmt=WPA-PSK
# Use WPA2
wpa=2
# Use CCMP
wpa_pairwise=CCMP
# passphrase
wpa_passphrase=passphrase' | sudo tee /etc/hostapd/hostapd.conf

sudo cp /etc/dnscrypt-proxy/dnscrypt-proxy.toml /etc/dnscrypt-proxy/dnscrypt-proxy.toml.bak

...
+listen_addresses = ['127.0.0.1:50000']
...
+cache = false
...

sudo cp /etc/dnsmasq.conf /etc/dnsmasq.conf.bak

echo "# listen interface
interface=uap0
# On systems which support it, dnsmasq binds the wildcard address,
# even when it is listening on only some interfaces. It then discards
# requests that it shouldn't reply to. This has the advantage of
# working even when interfaces come and go and change address. If you
# want dnsmasq to really bind only the interfaces it is listening on,
# uncomment this option. About the only time you may need this is when
# running another nameserver on the same machine.
bind-interfaces
# dhcp range 2~20, 12hrs to update dhcp lease
dhcp-range=192.168.50.2,192.168.50.20,255.255.255.0,12h

# Never forward plain names (without a dot or domain part)
domain-needed
# Never forward addresses in the non-routed address spaces.
bogus-priv
# upstream dns server
server=127.0.0.1#50000
# don't read /etc/resolv.conf
no-resolv
# listen for dns server on 192.168.50.1
listen-address=192.168.50.1
# dns cache size
cache-size=1000

conf-dir=/etc/dnsmasq.d/,*.conf" | sudo tee /etc/dnsmasq.conf

echo 'net.ipv4.ip_forward=1' | sudo tee /etc/sysctl.d/routed-ap.conf

sudo cp /etc/default/ufw /etc/default/ufw.bak

...
+DEFAULT_FORWARD_POLICY=“ACCEPT"
...

sudo cp /etc/ufw/before.rules /etc/ufw/before.rules.bak

...
*nat
-F
-A POSTROUTING -s 192.168.50.0/24 ! -d 192.168.50.0/24 -j MASQUERADE
COMMIT

...
# Don't delete these required lines, otherwise there will be errors
*filter
...

sudo systemctl enable ufw dnscrypt-proxy dnsmasq hostapd --now

sudo ufw allow dns
sudo ufw allow 67/udp

sudo systemctl reboot