I'm creating an access point with no Internet access. Users can view content hosted locally on a Raspberry Pi
I want a jump-off point where the user can share something on Facebook. At this point I would need them to be kicked from the WiFi network so they can use their own 3G/4G connection.
How can I force a mac address off the access point instantly without restarting hostapd?
You an use the hostapd_cli command to control the hostapd daemon. To force a client off the wifi you can use either the "disassociate" or the "deauthenticate" command.
hostapd_cli deauthenticate 00:5e:3d:38:fe:ab
make sure you have the ctrl_interface properly set in your hostapd config!
The default is this:
ctrl_interface=/var/run/hostapd
It depends on the Client if it will reconnect right away though. This could be "remedied" by filtering his packets using iptables so he doesn't get an IP anymore and thus is highly likely to not try and connect again.
NOTE: Doing the latter with iptables might make the client "blacklist" your AP, at least for a certain time!
NOTE2: If you do not provide a default route with your DHCP-Server you should not need to disconnect them from the wifi at all. Though most devices (Smartphones) will avoid the wifi alltogether since it's not what they expect (an internet connection).