Goal:
Home Network --> wlan0 --> VPN --> wlan1 --> Hotspot
Raspbian Jessie with Pixel:
Using inbuilt Wifi adapter to connect to my home network, while external one as hostpot. No ethernet. I have tried for over a week setting up my rpi 3 model b to use a VPN over hostpot using hostapd and many dhcp configs in vain.
Word of wisdom: Not a novice or an expert
I have borrowed my steps from many many online articles but there is no updated version to work with new rpi 3 b. I am gonna provide them as a reference here.
What works: wlan0 connected to home network VPN on Pi, with a static IP assigned to wlan1 Hostapd, isc-dhcp Driver for wlan1 installed IP address, subnet assigned to client.
What's not: Hotspot made out of VPN on client side (cellphone)
My suspect: iptables or network interfaces or dhcpcd.conf (located at etc/dhcpcd.conf)
Strange scenario: If "# iface default inet dhcp" gets added to interfaces, isc-dhcp fails! Even with hashed out I get this issue. Once removed, all worked!
Configuration Used:
DHCPD: /etc/dhcp/dhcpd.conf:
subnet 192.168.42.0 netmask 255.255.255.0 {
range 192.168.42.10 192.168.42.50;
option broadcast-address 192.168.42.255;
option routers 192.168.42.1;
default-lease-time 600;
max-lease-time 7200;
option domain-name "local";
option domain-name-servers 8.8.8.8, 8.8.4.4;
}
ISC-DHCP-Server: /etc/default/isc-dhcp-server:
INTERFACES="wlan1"
Hostapd: /etc/hostapd/hostapd.conf: (custom version was used here)
interface=wlan1
driver=rtl871xdrv
ssid=Net
hw_mode=g
channel=6
macaddr_acl=0
auth_algs=1
ignore_broadcast_ssid=0
wpa=2
wpa_passphrase=Test123
wpa_key_mgmt=WPA-PSK
wpa_pairwise=TKIP
rsn_pairwise=CCMP
/etc/default/hostapd:
DAEMON_CONF="/etc/hostapd/hostapd.conf"
Network Interface: /etc/network/interfaces:
auto lo
iface lo inet loopback
iface eth0 inet manual
allow-hotplug wlan0
iface wlan0 inet manual
wpa-conf /etc/wpa_supplicant/wpa_supplicant.conf
#allow-hotplug wlan1
iface wlan1 inet manual
# wpa-conf /etc/wpa_supplicant/wpa_supplicant.conf
up iptables-restore < /etc/iptables.nat.vpn.secure
DHCPCD: /etc/dhcpcd.conf:
interface wlan1
static ip_address=192.168.42.1/24
static routers=192.168.42.1
static domain_name_servers=192.168.42.1
NAT: /etc/sysctl.conf:
net.ipv4.ip_forward=1
sh -c "echo 1 > /proc/sys/net/ipv4/ip_forward"
VPN:
iptables -A INPUT -i tun0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -i tun0 -j DROP
iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE
sh -c "iptables-save > /etc/iptables.nat.vpn.secure"
Rules that renders no effect:
iptables -A FORWARD -i tun0 -o wlan1 -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -i wlan1 -o tun0 -j ACCEPT
Result:
VPN works on Pi. Hotspot works. No internet on client side. Client, basically a phone, gets assigned correct IP with subnet mask. Can't browse the Internet.
What's causing this failure?