Let's say, I have a "network" of two machines, connected by an Ethernet cable. Let's say, machine M is a 'master' and machine S a 'slave'.I am giving them such names because only M has access to the outside world. In other words, S has only one network interface which is used to connect to M. M is Debian, S is Windows.

Now, M has eth0 that is taken up by S, wlan0 which is used to connect to a wireless router and ppp0 which I recently added for availability reasons. Technically speaking, wlan0 is wlx........ and eth0 is enp....., but I'm simplifying things.

First off, what works without any problems?

Everything, when M is connected through wlan0. In this case, S has full internet access (I enabled forwarding in M's kernel). I can access M (and S through M, if desired) from the outside, etc.

But now, I added ppp0 (CDMA modem). To be precise, before setting it up as an interface, I just set up pppd, and I could do pon/poff even before I had a "proper" interface that could be controlled with ifup/ifdown. Why did I set up an interface? Because I noticed a problem that is the point of this post. Setting up a "proper" interface didn't help, by the way.

What is the problem?

When M's ppp0 is up and wlan0 is down, S (yes, S, not M) has a weird problem with internet access. On the surface of it, it looks like nothing works - I can't use a web browser, can't ping an outside host, etc. But next, I ran 'tcpdump -n icmp' on M's ppp0 when pinging an outside host from both M and S - just to find out that when a ping is initiated by S, I can see all outgoing icmp packets, but no incoming ones! Please note that I'm talking about the interface that's facing the outside world - so, there's no incoming icmp reply packets on the modem!

Otherwise, PPP works as expected for M. All protocols. Importantly, when on PPP, the machine gets a proper global IP address - I can ssh into M from the outside and get a normal ssh session w/o any freezes or any other problems. But at the same time, S is ignored by outside hosts.

Would appreciate any suggestions.


'ip route' output:

1 wlan UP, ppp DOWN

default via dev wlan0 onlink dev eth0 proto kernel scope link src dev wlan0 proto kernel scope link src 192.168.0.xx

Comment: is the wireless router. 192.168.0.xx is M's wlan0 is M's eth0

2 wlan DOWN, ppp UP

default dev ppp0 scope link dev eth0 proto kernel scope link src dev ppp0 proto kernel scope link src xxx.xxx.xxx.xxx

Comment: xxx.xxx.xxx.xxx is the global IP address that, in fact, makes M accessible from the outside.

'ip addr' for ppp0: inet xxx.xxx.xxx.xxx peer scope global ppp0

  • 1
    Hi, welcome to the forums. Can I ask that you please add the output from "ip route" command, before and after you start the ppp session. There are usually ip-up.d and ip-down.d scripts that run, adding or removing networks/gateways etc. Also, check your firewall. If enabled, it may have rules for the LAN device, but nothing for ppp. – sarlacii Jan 22 '20 at 14:34
  • Thank you. Done. No firewall rules active during the experiment. – vanhemt Jan 22 '20 at 23:06
  • You should have some NAT Masquerade rules. What does iptables -t nat -nvL give you? (If you don't have anything then that's your problem.) – roaima Jan 23 '20 at 0:10
  • Interesting. I certainly don't have any NAT Masquerade rules set up. So, S' packets have a globally meaningless return address, right? Could you please suggest what these rules should look like in my case ? Also, out of curiosity - why didn't this problem get in the way when I was on wlan? Thank you. – vanhemt Jan 23 '20 at 6:09

You need a firewall rule to hide the S machine behind your M machine public IP address:

iptables -t nat -A POSTROUTING -o ppp+ -j MASQUERADE

If this works for you I'll add some instructions to get this loaded at boot on a Debian system.

The reason you don't need this on your wlan0 interface is because the wireless router will be doing this for you already.

  • Thanks, that was it. No need for further instructions - I know how to persist iptables rules. – vanhemt Jan 24 '20 at 21:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.