1

So I am following the recipe below using Raspberry OS Buster Lite:

https://www.raspberrypi.org/documentation/configuration/wireless/access-point-routed.md

I can connect my laptop to the Pi (hostapd works) and obtain an IP without a problem (dhcp works), and I can also connect to it via SSH, but the routing part is not working (I cannot ping the Internet).

The single line below doesn't seem to work:

sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

and the command below complains about iptables-legacy being present:

sudo netfilter-persistent save

I suspect that the recent change to iptables using nftables is the culprit why this recipe doesn't work. But some other sources suggest to use the routing commands below so I don't really know:

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
iptables -A FORWARD -i eth0 -o wlan0 -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -i wlan0 -o eth0 -j ACCEPT

Add the fact that this recipe edits /etc/sysctl.d/routed-ap.conf and other sources edit /etc/sysctl.conf makes matter even more confusing.

Also there are other ways to make the routing persistence than the one presented in the recipe:

  1. Make a bash script into a systemd service and use systemctl.
  2. Make a bash script run from /etc/rc.local using iptables-restore.

Will some network/routing guru please shed some light into this confusing matter and just say what's the best practice for this newbie sysadmin? Thanks!

Improve this question
0

1 Answer 1

Reset to default
0

Although I don't have an answer, I second that question.

Adding iptables LOG rules do not show any traffic coming from the access point network when querying DNS (which OP probably meant with not being able to access the internet). Local servers in the eth0-network can be reached using their IP address.

To complicate matters, I have pihole running (10.10.0.103 in the mentioned article). Since pihole runs dnsmasq already, I start a second instance as

dnsmasq --port=0 --conf-file=/etc/dnsmasq.wlan0.conf

with content

interface=wlan0
dhcp-range=192.168.4.2,192.168.4.3,255.255.255.0,24h
dhcp-option=6,10.10.0.103
domain=wlan
address=/gw.wlan/192.168.4.1

Any suggestions why DNS is quietly ignored by something are highly apprechiated! enter code here

Improve this answer
7
  • Hi! I made a blog about this here: ekbann.blogspot.com/2020/10/…
    – ebann
    Commented Jan 18, 2021 at 13:08
  • The fix for me was adding Google’s DNS 8.8.8.8 in the file /etc/dhcpd.conf
    – ebann
    Commented Jan 18, 2021 at 13:12
  • Yeah, but that's cheating ;) The whole idea is to use pihole in order to NOT tell Google. I can insert Google's DNS on the device in the guest network as well and will get the same result. But that is not fixing the issue
    – Mulle
    Commented Jan 18, 2021 at 15:28
  • I couldn’t get my AP to automatically pick up my ISP’s DNS. You could use any DNS provider really. Did it work got you?
    – ebann
    Commented Jan 18, 2021 at 15:37
  • I have a Pi-Hole docker running in my UnRAID server. In that setup, UnRAID is able to use my ISP’s DNS automatically (plug and play at its finest).
    – ebann
    Commented Jan 18, 2021 at 15:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .