0

How can I set up networking such that devices in a local network connected to the second ethernet interface could use the internet available on the first ethernet interface?

Using iproute2 I have only got as far as creating a connection between the devices in the local network and the Linux PC, while Linux PC still has internet connection. However, this internet connection is unavailable to the devices in the local network.

[Edit 2] The current configuration is based on the the this guide.

I am guessing that my ip route addresses are not correct and therein lies the problem.

The setup is the following:

Internet
   |
   |
   |
(enp0s31f6) = Linux PC = (enx00249b233bda)
                                 |
                                 |
                                 |
                           NetworkSwitch
                                 |
                                 |
                                 |---(eth0) = Raspberry Pi 1
                                 |
                                 |
                                 |---(eth0) = Raspberry Pi 2

--     ethernet cable
|      ethernet cable
(eth0) network interface name

[Edit] The aim is to have Linux PC and all the Respberry Pis connected to the internet and to each other.

All devices have static IP addresses.

Linux PC is running Ubuntu 16.04

All settings not outlined below should be the default settings.

Linux PC current settings

ifconfig

enp0s31f6 Link encap:Ethernet  HWaddr 48:4d:7e:b1:94:4d  
          inet addr:128.40.57.144  Bcast:128.40.57.255  Mask:255.255.255.0
          inet6 addr: fe80::4a4d:7eff:feb1:944d/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:1806664 errors:0 dropped:82518 overruns:0 frame:0
          TX packets:81807 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:601022858 (601.0 MB)  TX bytes:15652101 (15.6 MB)
          Interrupt:19 Memory:f7100000-f7120000 

enx00249b233bda Link encap:Ethernet  HWaddr 00:24:9b:23:3b:da  
          inet addr:192.168.0.10  Bcast:192.168.0.255  Mask:255.255.255.0
          inet6 addr: fe80::224:9bff:fe23:3bda/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:300302 errors:0 dropped:0 overruns:0 frame:0
          TX packets:373077 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:26170910 (26.1 MB)  TX bytes:476407809 (476.4 MB)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:193 errors:0 dropped:0 overruns:0 frame:0
          TX packets:193 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:17086 (17.0 KB)  TX bytes:17086 (17.0 KB)

/etc/network/interfaces

# Static IP for internet connection
auto lo
iface lo inet loopback
auto enp0s31f6
iface enp0s31f6 inet static
address 128.40.57.144
netmask 255.255.255.0
gateway 128.40.50.245
dns-nameservers 144.82.250.1 193.160.250.1

# Network adapter interfacing with RPis
allow-hotplug enx00249b233bda
iface enx00249b233bda inet static
address 192.168.0.10
netmask 255.255.255.0
gateway 192.168.0.11
dns-nameservers 144.82.250.1 193.160.250.1
post-up ip route add 192.168.0.0/24 dev enx00249b233bda src 192.168.0.10 table rt2
post-up ip route add default via 192.168.0.11 dev enx00249b233bda table rt2
post-up ip rule add from 192.168.0.10/32 table rt2
post-up ip rule add to 192.168.0.10/32 table rt2

/etc/iproute2/rt_tables

#
# reserved values
#
255 local
254 main
253 default
0   unspec
#
# local
#
#1  inr.ruhep
1 rt2

ip route show

default via 128.40.50.245 dev enp0s31f6 onlink 
128.40.57.0/24 dev enp0s31f6  proto kernel  scope link  src 128.40.57.144 
169.254.0.0/16 dev enp0s31f6  scope link  metric 1000 
192.168.0.0/24 dev enx00249b233bda  proto kernel  scope link  src 192.168.0.10

Raspberry Pi 1 current settings

ifconfig

eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.0.22  netmask 255.255.255.0  broadcast 192.168.0.255
        inet6 fe80::3fa1:761c:f861:dae3  prefixlen 64  scopeid 0x20<link>
        ether dc:a6:32:2f:11:38  txqueuelen 1000  (Ethernet)
        RX packets 7489  bytes 537762 (525.1 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 7417  bytes 2128900 (2.0 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1000  (Local Loopback)
        RX packets 2270  bytes 215650 (210.5 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 2270  bytes 215650 (210.5 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

wlan0: flags=4099<UP,BROADCAST,MULTICAST>  mtu 1500
        ether dc:a6:32:2f:11:3b  txqueuelen 1000  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

/etc/network/interfaces

# interfaces(5) file used by ifup(8) and ifdown(8)

# Please note that this file is written to be used with dhcpcd
# For static IP, consult /etc/dhcpcd.conf and 'man dhcpcd.conf'

# Include files from /etc/network/interfaces.d:
source-directory /etc/network/interfaces.d

/etc/dhcpcd.conf

# A sample configuration for dhcpcd.
# See dhcpcd.conf(5) for details.

# Allow users of this group to interact with dhcpcd via the control socket.
#controlgroup wheel

# Inform the DHCP server of our hostname for DDNS.
hostname

# Use the hardware address of the interface for the Client ID.
clientid
# or
# Use the same DUID + IAID as set in DHCPv6 for DHCPv4 ClientID as per RFC4361.
# Some non-RFC compliant DHCP servers do not reply with this set.
# In this case, comment out duid and enable clientid above.
#duid

# Persist interface configuration when dhcpcd exits.
persistent

# Rapid commit support.
# Safe to enable by default because it requires the equivalent option set
# on the server to actually work.
option rapid_commit

# A list of options to request from the DHCP server.
option domain_name_servers, domain_name, domain_search, host_name
option classless_static_routes
# Respect the network MTU. This is applied to DHCP routes.
option interface_mtu

# Most distributions have NTP support.
#option ntp_servers

# A ServerID is required by RFC2131.
require dhcp_server_identifier

# Generate SLAAC address using the Hardware Address of the interface
#slaac hwaddr
# OR generate Stable Private IPv6 Addresses based from the DUID
slaac private

# Example static IP configuration:
#interface eth0
#static ip_address=192.168.0.10/24
#static ip6_address=fd51:42f8:caae:d92e::ff/64
#static routers=192.168.0.1
#static domain_name_servers=192.168.0.1 8.8.8.8 fd51:42f8:caae:d92e::1

# It is possible to fall back to a static IP if DHCP fails:
# define static profile
#profile static_eth0
#static ip_address=192.168.1.23/24
#static routers=192.168.1.1
#static domain_name_servers=192.168.1.1

# fallback to static profile on eth0
#interface eth0
#fallback static_eth0

# Static IP for connection to Recording PC
interface eth0
static ip_address=192.168.0.22/24
static routers=192.168.0.11
static domain_name_servers=192.168.0.11
Improve this question
2
  • Your configuration mentions something called a "Recording PC" with IP address 192.168.0.11. Where is it and can it access internet in some way other than via 192.168.0.10? Or is 192.168.0.11 just an address plucked out of thin air, not associated with any particular device?
    – telcoM
    Commented Sep 29, 2019 at 17:37
  • Recording PC is Linux PC. It has access to internet via enp0s31f6 interface. 192.168.0.11 is the gateway set on the Linux PC interface enx00249b233bda based on Linux PC /etc/network/interfaces. I hope this helps
    – AlexU
    Commented Sep 29, 2019 at 18:00

1 Answer 1

Reset to default
2

Your RasPis can currently talk to the Linux PC because it is in the same network segment and has IP address 192.168.0.10. But when a RasPi attempts to access something in the internet, it will attempt to send the packets to 192.168.0.11 for further routing. But because the Linux PC's address on the RasPi network side is 192.168.0.10, not .11, the Linux PC will never receive the RasPi's outgoing packets and so cannot route them.

This is wrong: the RasPis should have their router/gateway address set to 192.168.0 .10, not .11.

When you specify gateway 192.168.0.11 in Linux PC's configuration for enx00249b233bda, it does not mean that the Linux PC should claim the .11 address for its own - it means you're saying there's some other system in the RasPi network with the .11 address that has internet connectivity.

This is wrong: the Linux PC does not need a gateway configuration line for enx00249b233bda, because the Linux PC is the gateway for the RasPi network. You should remove or comment out the gateway line from the configuration of the enx00249b233bda interface.

I don't see why you would need any of the ip route add stuff: just configuring the network interface will auto-generate a route to the 192.168.0.0/24 network, which is enough for your needs. Comment out all the ip route add commands, reboot, and keep reading.

Since you apparently have just one public IP address, you would have to set up IP masquerading on the Linux PC. With plain iptables it would be done like this:

iptables -w -t nat -A POSTROUTING -s 192.168.0.0/24 -o enp0s31f6 -j MASQUERADE

Then, you'll need some very basic rules to enable IP forwarding from the RasPi network to the outside world, and to accept any response packets back in:

iptables -w -t filter -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -w -t filter -A FORWARD -i enx00249b233bda -j ACCEPT

For certain protocols that need special connection tracking helpers, you may have to add lines as follows (this used to be automatic, until someone found a way to abuse it. That's why we can't have nice things... grumble...):

iptables -w -t raw -A PREROUTING -i enx00249b233bda -p tcp --dport 21 -j CT --helper ftp

This activates the required special handling for outgoing FTP control connections from your RasPi network to the internet. The special handling will monitor the FTP control connection and automatically allow corresponding data connections to pass. There are a few other protocols that may require similar treatment.

Besides FTP, other protocols that would need special treatment could be:

  • SNMP (UDP port 161, helper name snmp)
  • SIP (TCP and UDP, port 5060, helper name sip)
  • IRC chat (TCP, port number may vary, helper name irc)

(I know that Ubuntu has ufw, but I have no idea how to use that to set up equivalent firewall rules. If someone else knows, feel free to edit it in here.)

All of the above will be completely ineffective until you activate the IPv4 routing master switch. First, make sure that /etc/sysctl.conf file has this line in it:

net.ipv4.ip_forward=1

Then either reboot, or run this command to make the setting effective immediately:

sudo sysctl -p

(Why does this master switch thing exist? Basically to make it more likely that whoever is configuring their system as a router has "done their homework" and so has a chance of not causing routing loops or any other dumb things in the network.)

Improve this answer
1
  • 1
    Thank you! Only two more steps until everything was working. Set the RasPi /etc/dhcpcd.conf static domain_name_servers equal to same as dns-nameservers in /etc/network/interfaces on Linux PC. Installed iptables-persistent on Linux PC to keep iptables changes after rebooting.
    – AlexU
    Commented Sep 29, 2019 at 19:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .