Routing all traffic from eth0 to wlan0

Question

I have a wifi access point that I'm connecting to through my Raspberry Pi on wlan0. I have a DHCP server setup on my Raspberry Pi to give out addresses on eth0. I have an old router setup attached to eth0, which is then just transmitting its own access point and doing some other stuff.

It kinda looks like this:

[main wifi AP] <-wlan0-> [raspberry pi] <- pi's eth0 -> (router/client)

The DHCP server is giving out addresses just fine, but I'm having trouble getting the traffic to route from eth0 to wlan0 (not sure if that makes any sense). I can also ssh into the pi without issue too.

I am using a couple of rules for iptables to try to do this, but it doesn't seem to be working at all. I cannot connect to any address outside of the local network. E.g., I can't connect to the DNS server that the main AP gave out through DHCP to my Raspberry Pi, whether I use the router in between the Pi & laptop.

Here is the dump of iptables-save:

# Generated by iptables-save v1.4.21 on Wed Feb 24 01:11:24 2016
*nat
:PREROUTING ACCEPT [1:32]
:INPUT ACCEPT [1:32]
:OUTPUT ACCEPT [7:432]
:POSTROUTING ACCEPT [5:336]
-A POSTROUTING -o eth0 -j MASQUERADE
COMMIT
# Completed on Wed Feb 24 01:11:24 2016
# Generated by iptables-save v1.4.21 on Wed Feb 24 01:11:24 2016
*filter
:INPUT ACCEPT [3:140]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [5:308]
-A FORWARD -i wlan0 -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i eth0 -o wlan0 -j ACCEPT
COMMIT
# Completed on Wed Feb 24 01:11:24 2016

Anyone have any ideas as to why it can't connect outside of the local network?

Answer 1

Introduction

I will take some assumptions as there hasn't been enough information to make a complete and functional example, but the changes should be trivial.

Assumptions

1. The network attached to RaspberryPi's wlan0 is 192.168.1.0/24.
2. The network attached to RaspberryPi's eth0 is 192.168.2.0/24.
3. RaspberryPi's wlan0 device has assigned the IP addresses 192.168.1.1 and eth0 192.168.2.1.

Procedure

1. Remove all the iptables things in the RaspberryPi.

2. Allow IPv4 Forwarding in the RaspberryPi:

     # Execute as "root"
   echo net.ipv4.ip_forward=1 >> /etc/sysctl.conf
   sysctl -p
   

3. Instruct the devices attached to the RaspberryPi's wlan0 network to use it as gateway for the wired network. That would allow packets to traverse from 192.168.1.0/24 to 192.168.2.0/24, but the responses to those packets won't be able to come back (solved in the next point).

   • If you have a Linux machine in the wirless network you can add an ephemeral route which can help you test the configuration but won't survive a reboot and other events (depending on the Linux distro, you may have to edit different files in order to persistently establish this configuration). Remember you have to wait until the next point to be able to get a successful test. Simply, execute:

     ip route replace 192.168.2.0/24 via 192.168.1.1
     

4. Instruct the devices attached to the RaspberryPi's eth0 network to use it as gateway for the wireless network.

   • If you have a Linux machine in the wired network you can add an ephemeral route which can help you fully test the configuration but won't survive a reboot and other events (depending on the Linux distro, you may edit different files in order to persistently establish this configuration). Execute:

     ip route replace 192.168.1.0/24 via 192.168.2.1
     

   • If you want to turn RaspberryPi into the wired network's default gateway instead, the command above should be changed to:

     ip route replace default via 192.168.2.1
     

   • Additionally, you may want to make this new default gateway configuration automatic. If you are using ISC DHCP Server in RaspberryPi to serve the wired network, you can add the following line at the beggining of the "dhcp3.conf" configuration file and then restart the server in order to make the default gateway configuration served by DHCP:

     option routers 192.168.2.1
     

Answer 2

I've done almost exactly what you describe with my Rasberry Pi. I directly connected it to my laptop's ethernet port with a crossover cable. I think that's important. I'm not sure what's wrong with you configuration, but I suspect there's a couple of things. I run this script on my laptop:

#!/bin/bash
/usr/bin/ip link set dev enp9s0 up
/usr/bin/ip addr add 172.16.1.1/24 dev enp9s0
sleep 10

modprobe iptable_nat
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A POSTROUTING -s 172.16.1.0/24 -j MASQUERADE
iptables -A FORWARD -o enp9s0 -i wlp0s26f7u3 -s 172.16.1.0/24 -m conntrack --ctstate NEW -j ACCEPT
iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

dhcpd -cf /etc/dhcpd.enp9s0.conf enp9s0

enp9s0 is the name of the ethernet port, wlp0s26f7u3 is the name of a USB wireless card on the laptop.

The file /etc/dhcpd.enp9s0.conf looks like this:

option domain-name "wlan";
option domain-name-servers 10.0.0.3;
option routers 172.16.1.1;
option ntp-servers 10.0.0.3;
default-lease-time 14440;
ddns-update-style none;
deny bootp;
shared-network intranet {
        subnet 172.16.1.0 netmask 255.255.255.0 {
                option subnet-mask 255.255.255.0;
                pool { range 172.16.1.50 172.16.1.200; }
        }
}

Then I power on the Raspberry Pi. After a few seconds, I can use arp -a to see it's hardware address and IP address (172.16.1.50, probably), and then ssh into it.