0

Let's say, I have a "network" of two machines, connected by an Ethernet cable. Let's say, machine M is a 'master' and machine S a 'slave'.I am giving them such names because only M has access to the outside world. In other words, S has only one network interface which is used to connect to M. M is Debian, S is Windows.

Now, M has eth0 that is taken up by S, wlan0 which is used to connect to a wireless router and ppp0 which I recently added for availability reasons. Technically speaking, wlan0 is wlx........ and eth0 is enp....., but I'm simplifying things.

First off, what works without any problems?

Everything, when M is connected through wlan0. In this case, S has full internet access (I enabled forwarding in M's kernel). I can access M (and S through M, if desired) from the outside, etc.

But now, I added ppp0 (CDMA modem). To be precise, before setting it up as an interface, I just set up pppd, and I could do pon/poff even before I had a "proper" interface that could be controlled with ifup/ifdown. Why did I set up an interface? Because I noticed a problem that is the point of this post. Setting up a "proper" interface didn't help, by the way.

What is the problem?

When M's ppp0 is up and wlan0 is down, S (yes, S, not M) has a weird problem with internet access. On the surface of it, it looks like nothing works - I can't use a web browser, can't ping an outside host, etc. But next, I ran 'tcpdump -n icmp' on M's ppp0 when pinging an outside host from both M and S - just to find out that when a ping is initiated by S, I can see all outgoing icmp packets, but no incoming ones! Please note that I'm talking about the interface that's facing the outside world - so, there's no incoming icmp reply packets on the modem!

Otherwise, PPP works as expected for M. All protocols. Importantly, when on PPP, the machine gets a proper global IP address - I can ssh into M from the outside and get a normal ssh session w/o any freezes or any other problems. But at the same time, S is ignored by outside hosts.

Would appreciate any suggestions.

UPD:

'ip route' output:

1 wlan UP, ppp DOWN

default via 192.168.0.1 dev wlan0 onlink

10.42.0.0./24 dev eth0 proto kernel scope link src 10.42.0.1

192.168.0.0/24 dev wlan0 proto kernel scope link src 192.168.0.xx

Comment: 192.168.0.1 is the wireless router. 192.168.0.xx is M's wlan0 10.42.0.1 is M's eth0

2 wlan DOWN, ppp UP

default dev ppp0 scope link

10.42.0.0/24 dev eth0 proto kernel scope link src 10.42.0.1

172.17.4.111 dev ppp0 proto kernel scope link src xxx.xxx.xxx.xxx

Comment: xxx.xxx.xxx.xxx is the global IP address that, in fact, makes M accessible from the outside.

'ip addr' for ppp0: inet xxx.xxx.xxx.xxx peer 172.17.4.111/32 scope global ppp0

Improve this question
4
  • 1
    Hi, welcome to the forums. Can I ask that you please add the output from "ip route" command, before and after you start the ppp session. There are usually ip-up.d and ip-down.d scripts that run, adding or removing networks/gateways etc. Also, check your firewall. If enabled, it may have rules for the LAN device, but nothing for ppp.
    – sarlacii
    Jan 22, 2020 at 14:34
  • Thank you. Done. No firewall rules active during the experiment.
    – vanhemt
    Jan 22, 2020 at 23:06
  • You should have some NAT Masquerade rules. What does iptables -t nat -nvL give you? (If you don't have anything then that's your problem.)
    – roaima
    Jan 23, 2020 at 0:10
  • Interesting. I certainly don't have any NAT Masquerade rules set up. So, S' packets have a globally meaningless return address, right? Could you please suggest what these rules should look like in my case ? Also, out of curiosity - why didn't this problem get in the way when I was on wlan? Thank you.
    – vanhemt
    Jan 23, 2020 at 6:09

1 Answer 1

Reset to default
0

You need a firewall rule to hide the S machine behind your M machine public IP address:

iptables -t nat -A POSTROUTING -o ppp+ -j MASQUERADE

If this works for you I'll add some instructions to get this loaded at boot on a Debian system.

The reason you don't need this on your wlan0 interface is because the wireless router will be doing this for you already.

Improve this answer
1
  • Thanks, that was it. No need for further instructions - I know how to persist iptables rules.
    – vanhemt
    Jan 24, 2020 at 21:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .