I have a Raspberry Pi running Linux (Raspbian) which is connected to my corporate Internet over an Ethernet cable. The RPi also has a wifi adaptor plugged into a USB port. I've been following along the with Ada Fruit's Raspberry Pi Access Point Tutorial, but there is a snag.

I only want to allow connections from the wifi USB adaptor to reach services running on the RPi. I don't want them to be allowed to connect to the corporate network in any way. The RPi is running a service which should be available both over the corporate intranet and over the wifi connection. The RPi must not route any connection between the wifi network and the corporate intranet.

My question is, what part of the tutorial should I follow, and should I not follow to make this setup work?

  • 1
    “allow connections from the WiFi device to connect to the loopback interface” doesn't make sense — if they're on a wifi interface, they aren't on a loopback interface. Is the RPi connected to your corporate network, or to a PC which is connected to your corporate network? Is “the WiFi device” the RPi or another device? Who's providing the wifi, you or corporate? Please clarify the network topology: which machines are involved, how they are connected, which programs are running where. – Gilles 'SO- stop being evil' Nov 29 '14 at 23:30
  • @Gilles The USB dongle connected to the RPi is providing the WiFi, I want to make it so that the WiFi connection provided by the RPi can only connect to the localhost on the RPi and not the network connected via the Ethernet interface. Thanks for the feedback, I wasn't sure that I was explaining myself correctly, and now I know for sure. I've updated the OP to hopefully make more sense. – Mark Tomlin Nov 30 '14 at 0:00
  • There were still several contradictory statements in your question (connections to the loopback interface which were not from the loopback interface? that makes no sense). I've edited your question based on my understanding, please review my edit to make sure that it reflects what you want to do. – Gilles 'SO- stop being evil' Nov 30 '14 at 0:23
  • Sorry @Gilles, I want the Ethernet Connection to work as normal as everyone would expect it too (Plugin an Ethernet cable, and it gets an IP address and is able to access the network.) I want the WiFi USB Dongle to act as a Access Point but only to allow access the Web Server on on the Raspberry Pi, and not allow any WiFi client's traffic to cross over too the Ethernet. – Mark Tomlin Dec 1 '14 at 5:28

The section you should ignore is the Configure Network Address Translation section. In fact if you want to guarantee that wireless clients can't go onto the Ethernet connection do the following:

Run sudo nano /etc/sysctl.conf. Scroll to the bottom and add net.ipv4.ip_forward=0 on a new line. Save the file. This will disable ip forwarding on boot up.

Run: sudo sh -c "echo 0 > /proc/sys/net/ipv4/ip_forward"

This will disable IP forwarding immediately (it should be disabled already). This will guarantee that there is no IP forwarding on your Pi.

If you want to go a little further, you can also disable it at the firewall, but adding the following iptables rules.

sudo iptables -A FORWARD -i wlan0 -o eth0 -j DENY
sudo sh -c "iptables-save > /etc/iptables.ipv4.nat"

Run sudo nano /etc/network/interfaces and add up iptables-restore < /etc/iptables.ipv4.nat to the very end. Save and close the file.

That should disable all traffic from wireless to the corporate network.

For more information about Linux networking options take a look here: https://www.kernel.org/doc/Documentation/sysctl/net.txt

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.