1

Can anyone assist with a linux routing question? Essentially I want to use an Ubuntu laptop to provide internet access to an attached network.

I have a Raspberry pi on a wifi network (192.168.42.0/24). Its ip address is 192.168.42.20.

Internet access is provided by a cell phone hotspot. (192.168.43.0/24). The internet gateway is 192.168.43.1

I have a linux laptop (Ubuntu) with two wifi cards - one on each of the above networks. (192.168.42.21 & 192.168.43.10)

I also have another network connected on the ethernet card which successfully shares the internet connection with clients. This network is 10.42.0.0/24. The laptop is a DHCP server in this case and its ip is 10.42.0.1

I am trying to use the laptop to provide an internet access route for the Pi I have added the following iptable rules to the laptop. They are derived from the forwarding rules for the 10.42.0./24 network which as I say can connect to the internet.

-A FORWARD -d 192.168.42.0/24 -o wlx801f0281f02a -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -s 192.168.42.0/24 -i wlx801f0281f02a -j ACCEPT
-A FORWARD -i wlx801f0281f02a -o wlx801f0281f02a -j ACCEPT
ip_forwarding is enabled

I have added a route on the Pi. The route table now reads:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.42.21   0.0.0.0         UG    0      0        0 wlan0
192.168.42.0    0.0.0.0         255.255.255.0   U     303    0        0 wlan0

The Pi can ping through to both the other networks and both other networks can ping through to the Pi.

BUT ... the Pi still doesn't have internet access, although a device on the 10.42.0.117 happily reaches the outside world.

The routing table on 10.42.0.117 is exactly "parallel" to the Pi's:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         10.42.0.1       0.0.0.0         UG    0      0        0 eth0
10.42.0.0       0.0.0.0         255.255.255.0   U     0      0        0 eth0
127.0.0.0       0.0.0.0         255.0.0.0       U     0      0        0 lo

What am I missing?

  • Use traceroute to find where your Internet communcation is being droped. Does your internet gateway (192.168.43.1) know how to reach 192.168.42.0 network? – YoMismo Jul 15 at 15:17
  • If you don't know about the gateway why not NATing? If you can reach the Internet from your laptop and NAT 192.168.42.20 with your laptop IP you will be able to reach the Internet from the Pi. – YoMismo Jul 15 at 15:39
  • I'd tried traceroute but couldn't gleam anything useful <br/> Here is the traceroute from the Pi device: <br/> traceroute to 8.8.8.8 (8.8.8.8), 30 hops max, 60 byte packets <br/> 1 192.168.42.21 (192.168.42.21) 3.345 ms 4.386 ms 5.614 ms <br/> 2 * * * <br/> 3 * * * <br/> 4 * * * <br/> 5 * * * <br/> I'm not sure if the gateway knows how to reach 192.168.42.0 but it can reach the 10.42.0.0 network without any intervention on my part. <br/> The gateway is an android hotspot. It doesn't even respond to pings and I can't ssh into it either. <br/> – Gary Smith Jul 15 at 15:42
  • Implementing NAT seems like a workaround rather than a direct solution. But I'm wondering if that is what is happening with the 10.42.0.0 network? How can I tell if NAT is being used on 10.42.0.0? And secondly can you point me to a good example (simple) for implementing NAT? – Gary Smith Jul 15 at 15:47
  • ok, thanks @YoMismo not to worry, I'm using sudo iptables -t nat -L -n -v to show me the NAT tables. – Gary Smith Jul 15 at 16:04
2

so the answer (after @YoMismo put me on the right track) is to add one more iptables rule:

sudo iptables --table nat -A POSTROUTING -s 192.168.42.0/24 ! -d 192.168.42.0/24 -j MASQUERADE

The result can be seen with

sudo iptables -t nat -L -n -v

So in summary: Add a route on the device requiring access as follows:

sudo ip route add 0.0.0.0/0 via 192.168.42.21 dev wlan0 

192.168.42.21 is the ip address of the "bridging" wifi adapter on the "linux router"

Then add the iptables rules to the "linux router" as follows:

sudo iptables -A FORWARD -d 192.168.42.0/24 -o wlx801f0281f02a -m state --state RELATED,ESTABLISHED -j ACCEPT
sudo iptables -A FORWARD -s 192.168.42.0/24 -i wlx801f0281f02a -j ACCEPT
sudo iptables -A FORWARD -i wlx801f0281f02a -o wlx801f0281f02a -j ACCEPT
sudo iptables --table nat -A POSTROUTING -s 192.168.42.0/24 ! -d 192.168.42.0/24 -j MASQUERADE

Again, wlx801f0281f02a is the bridging wifi dongle interface that I'm using to connect to the network 192.168.42.0/24.

So internet requests on the source device are routed using the route on the source device to 192.168.42.21 on the "linux router" where is it NAT'ed and forwarded to the gateway.

Note that ip_forward was already enabled.

Make the rules persistent or put them in a bash script if the requirement is temporary/ad hoc.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.