We are currently setting up a system where we are using a Linux computer (debian) that acts as a WiFi control and router. The Linux computer connects to two WiFi networks (let's call them A and B) via WiFi (wlan0 and wlan1). A PC is then connected via ethernet to the Linux box to allow it access to any device on the two WiFi networks. See ASCII art image

                                             WiFi A (192.170.1.xx)
PC (192.168.2.xx) ----- ( Linux ( 
                                             WiFi B (192.170.1.xx)

Protocols that we need routed:

  1. SSH to any 192.170.1.xx device from PC
  2. TCP on ports 1234/4321 to any 192.170.1.xx device from PC
  3. PING to any 192.170.1.xx device from PC

The question relates to how to setup the IPTables

  • The PC has the gateway set to so any packets that the PC sends to 192.170.1.xx will be routed to the Linux box?

This is what I think should work (not yet tested). Could you please indicate if this is correct or I have a fundamental mistake in my logic?

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
iptables -A FORWARD -i eth0 -o wlan0 -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -i eth0 -o wlan 1-m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -i wlan0 -o eth0 -j ACCEPT
iptables -A FORWARD -i wlan1 -o eth0 -j ACCEPT

Note: Wifi A and B must be in different subnets otherwise the Linux system will complain.

I will assume that eth0 is for the PC, then you can use this rule to achieve what you want for the ssh and tcp ports:

iptables -t filter -A FORWARD -i eth0 -o <Interface> -d <Des subnet> -p tcp --dport <Des Port> -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT

To allow ping you can use:

iptables -t filter -A FORWARD -i eth0 -o <Interface> -d <Des subnet> -p icmp --icmp-type 8 -j ACCEPT
  • Thanks this has worked. Would the TCP part also work for a TCP connection coming back from the WiFi devices?
    – Lhh92
    Aug 20 '17 at 10:31

Since you seem to be using the same address range for Wifi A and WiFi B and the Linux box only has one address in that range I think you would need to bridge the two wlan interfaces (ie treat them as a single network) in which case your iptables rules would need to reference the bridge interface.
See this question for some ideas about configuring filtering on a bridged network. Alternatively if you have assigned different subnets of 192.170.1.xx to each wifi network then the linux box will need 1 ip address on each subnet not the single address you indicate.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.