0

I'm trying to use a Raspberry Pi to act similarly to a network bridge by using iptables with MASQUERADE. Although I know there are many technical reasons that this is not a bridge, all I need to do is get web traffic from the hardwired port eth0 to the wireless network the Pi is connected to through wlan0. However, it seems not to be working; even though there is internet access on the Pi, DNS fails on the computer I wish to connect to the network through the Pi.

Following the instructions here, I used the following commands:

echo "1" > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A POSTROUTING -o wlan0 -j MASQUERADE

I wanted this to work and run as soon as wlan0 is enabled, so I added it to /etc/network/interfaces in a post-up clause. I noticed that the Pi failed to properly obtain the gateway from the DHCP on the network, so I had it set that manually in the same statement. Here is the full contents of /etc/network/interfaces:

auto lo
iface lo inet loopback

iface eth0 inet manual

allow-hotplug wlan0
iface wlan0 inet manual
        wpa-conf /etc/wpa_supplicant/wpa_supplicant.conf
        post-up route add default gw 10.110.0.11; echo "1" > /proc/sys/net/ipv4/ip_forward ; iptables -t nat -A POSTROUTING -o wlan0 -j MASQUERADE

The Pi is configured to have a static IP in /etc/dhcpcd.conf using the following:

interface eth0
static ip_address=192.168.0.5/24
static routers=192.168.0.5
static domanin_name_servers=8.8.8.8 8.8.4.4

Then, on the computer I wish to receive the connection on, I configure it to have its own IP in the same subnet (I picked 192.168.0.2), have the same subnet mask (255.255.255.0), and I set the gateway to 192.168.0.5. While I can see the Pi from the computer (I can ping and ssh to it), it doesn't seem to be receiving the internet connection through it; I can't visit any website, DNS lookup fails. How can I resolve this?

Thanks for your help!

1

As you said yourself, using NAT (via iptables masquerade) doesn't turn the RaspPi into a bridge. And there are technical reason (3-address mode on the WLAN network) why you can't just bridge WLAN and LAN, no matter on what kind of hardware.

What NAT does is to pretend that traffic coming from the LAN behind the RaspPi really originates from the RaspPi itself, so the WLAN only sees every a single host (the RaspPi). What WLAN does not do is to somehow forward layer 2 broadcasts from WLAN to LAN. But that is needed for DHCP.

And no amount of fiddling with iptables will do that for you.

So the simplest option is to run a DHCP server on the RaspPi. That's what I do, and it really works well.

If for some reason you have to use the DHCP information provided via the DHCP server on the WLAN, because it gives your machines super special custom information that only can be discovered in that way (unlikely), it gets more tricky. The limit is still that the whole assembly must appear as a single host on the WLAN, but you can use WLAN_Kabel to pretend this host is a single device on the RaspPi's LAN. This works by bypassing the Linux network stack (and iptables) and rewriting the layer 2 frames directly, forwarding them between LAN and WLAN. It will also make your RaspPi unreachable on the WLAN.

If this is not enough, and you have to have several devices, the only way is to enable 4-address-mode on your WLAN. This needs to be supported by all WLAN devices, and comes with its own headaches, so this is really the last resort.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.