Can anyone assist with a linux routing question? Essentially I want to use an Ubuntu laptop to provide internet access to an attached network.

I have a Raspberry pi on a wifi network ( Its ip address is

Internet access is provided by a cell phone hotspot. ( The internet gateway is

I have a linux laptop (Ubuntu) with two wifi cards - one on each of the above networks. ( &

I also have another network connected on the ethernet card which successfully shares the internet connection with clients. This network is The laptop is a DHCP server in this case and its ip is

I am trying to use the laptop to provide an internet access route for the Pi I have added the following iptable rules to the laptop. They are derived from the forwarding rules for the 10.42.0./24 network which as I say can connect to the internet.

-A FORWARD -d -o wlx801f0281f02a -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -s -i wlx801f0281f02a -j ACCEPT
-A FORWARD -i wlx801f0281f02a -o wlx801f0281f02a -j ACCEPT
ip_forwarding is enabled

I have added a route on the Pi. The route table now reads:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface         UG    0      0        0 wlan0   U     303    0        0 wlan0

The Pi can ping through to both the other networks and both other networks can ping through to the Pi.

BUT ... the Pi still doesn't have internet access, although a device on the happily reaches the outside world.

The routing table on is exactly "parallel" to the Pi's:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface         UG    0      0        0 eth0   U     0      0        0 eth0       U     0      0        0 lo

What am I missing?

  • Use traceroute to find where your Internet communcation is being droped. Does your internet gateway ( know how to reach network? – YoMismo Jul 15 '19 at 15:17
  • If you don't know about the gateway why not NATing? If you can reach the Internet from your laptop and NAT with your laptop IP you will be able to reach the Internet from the Pi. – YoMismo Jul 15 '19 at 15:39
  • I'd tried traceroute but couldn't gleam anything useful <br/> Here is the traceroute from the Pi device: <br/> traceroute to (, 30 hops max, 60 byte packets <br/> 1 ( 3.345 ms 4.386 ms 5.614 ms <br/> 2 * * * <br/> 3 * * * <br/> 4 * * * <br/> 5 * * * <br/> I'm not sure if the gateway knows how to reach but it can reach the network without any intervention on my part. <br/> The gateway is an android hotspot. It doesn't even respond to pings and I can't ssh into it either. <br/> – Gary Smith Jul 15 '19 at 15:42
  • Implementing NAT seems like a workaround rather than a direct solution. But I'm wondering if that is what is happening with the network? How can I tell if NAT is being used on And secondly can you point me to a good example (simple) for implementing NAT? – Gary Smith Jul 15 '19 at 15:47
  • ok, thanks @YoMismo not to worry, I'm using sudo iptables -t nat -L -n -v to show me the NAT tables. – Gary Smith Jul 15 '19 at 16:04

so the answer (after @YoMismo put me on the right track) is to add one more iptables rule:

sudo iptables --table nat -A POSTROUTING -s ! -d -j MASQUERADE

The result can be seen with

sudo iptables -t nat -L -n -v

So in summary: Add a route on the device requiring access as follows:

sudo ip route add via dev wlan0 is the ip address of the "bridging" wifi adapter on the "linux router"

Then add the iptables rules to the "linux router" as follows:

sudo iptables -A FORWARD -d -o wlx801f0281f02a -m state --state RELATED,ESTABLISHED -j ACCEPT
sudo iptables -A FORWARD -s -i wlx801f0281f02a -j ACCEPT
sudo iptables -A FORWARD -i wlx801f0281f02a -o wlx801f0281f02a -j ACCEPT
sudo iptables --table nat -A POSTROUTING -s ! -d -j MASQUERADE

Again, wlx801f0281f02a is the bridging wifi dongle interface that I'm using to connect to the network

So internet requests on the source device are routed using the route on the source device to on the "linux router" where is it NAT'ed and forwarded to the gateway.

Note that ip_forward was already enabled.

Make the rules persistent or put them in a bash script if the requirement is temporary/ad hoc.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.