I am looking to find out exactly what steps must be taken to manually provision a shared internet connection on a workstation running a Linux based operating system.

I am aware that when using any Linux distribution which is configured to use systemd as it's init system with the NetworkManager service installed, one has the ability to configure a shared internet connection between two interfaces in an automated fashion (either with the system's native network settings or with a utility such as nm-connection-editor). It stands to reason that if one could observe the changes made to the system after configuring the shared internet connection using the automated method, one would possess the knowledge required to manually recreate it. With that in mind, here are the steps I've taken towards this and what I've discovered:

  1. The interface that's 'receiving' the shared connection is assigned the IP address with a /24 sub-net mask by default

  2. dnsmasq is provisioned to provide DHCP and DNS services, listening on by default.

    • DHCP offers IP addresses within the range of and DNS points back to the primary resolver of the host interface
  3. The routing table is modified to include a route for the sub-net of the interface 'receiving' the shared connection. i.e. dev enp1s0 proto kernel scope link src

  4. A series of ipv4/ipv6 related sysctl kernel parameters are changed. I dumped the relevant sysctl parameters before and after using the following bit of bash:

mybox ~ # sysctl -a | egrep "ipv4|ipv6" > sysctl_before


mybox ~ # sysctl -a | egrep "ipv4|ipv6" > sysctl_after

I then diffed the two files, which yielded the following:

< net.ipv4.conf.all.accept_redirects = 1
> net.ipv4.conf.all.accept_redirects = 0
< net.ipv4.conf.all.forwarding = 0
> net.ipv4.conf.all.forwarding = 1
< net.ipv4.conf.default.forwarding = 0
> net.ipv4.conf.default.forwarding = 1
< net.ipv4.conf.enp1s0.forwarding = 0
> net.ipv4.conf.enp1s0.forwarding = 1
< net.ipv4.conf.lo.forwarding = 0
> net.ipv4.conf.lo.forwarding = 1
< net.ipv4.conf.wlp2s0.forwarding = 0
> net.ipv4.conf.wlp2s0.forwarding = 1
< net.ipv4.ip_dynaddr = 0
> net.ipv4.ip_dynaddr = 1
< net.ipv4.ip_forward = 0
> net.ipv4.ip_forward = 1
< net.ipv6.conf.all.forwarding = 0
> net.ipv6.conf.all.forwarding = 1
< net.ipv6.conf.default.forwarding = 0
> net.ipv6.conf.default.forwarding = 1
< net.ipv6.conf.enp1s0.forwarding = 0
> net.ipv6.conf.enp1s0.forwarding = 1
< net.ipv6.conf.lo.forwarding = 0
> net.ipv6.conf.lo.forwarding = 1
< net.ipv6.conf.wlp2s0.forwarding = 0
> net.ipv6.conf.wlp2s0.forwarding = 1

I did the same thing for the filter and nat iptables rule-sets which yielded the following:


> -A INPUT -i enp1s0 -p udp -m udp --dport 67 -j ACCEPT
> -A INPUT -i enp1s0 -p tcp -m tcp --dport 67 -j ACCEPT
> -A INPUT -i enp1s0 -p udp -m udp --dport 53 -j ACCEPT
> -A INPUT -i enp1s0 -p tcp -m tcp --dport 53 -j ACCEPT
> -A FORWARD -d -o enp1s0 -m state --state RELATED,ESTABLISHED -j ACCEPT
> -A FORWARD -s -i enp1s0 -j ACCEPT
> -A FORWARD -i enp1s0 -o enp1s0 -j ACCEPT
> -A FORWARD -o enp1s0 -j REJECT --reject-with icmp-port-unreachable
> -A FORWARD -i enp1s0 -j REJECT --reject-with icmp-port-unreachable



It doesn't appear that these changes alone are enough to produce a working shared internet connection, however, because reproducing them manually doesn't give me the glorious ping response from I am desperately seeking.

For clarity's sake, I've also ensured that any clients making use of the shared connection have a default route in place that designates as the default gateway.

Can anyone help me understand what it is that I am missing?

  • Did you also look at the routing tables?
    – muru
    Dec 14, 2020 at 8:35
  • Yes, I included in the question the route that is added on the device sharing the internet connection and stated in the question that I made sure to include a route defining as the default gateway on any clients. I'll edit the question to further clarify this. Dec 14, 2020 at 9:00
  • Ah. Yes, sorry I missed that. Is that output correct, though? It mentions eth0, and your iptables outputs use enp1s0.
    – muru
    Dec 14, 2020 at 9:07
  • Yeah that's my bad, I used eth0 as an example because I have a few boxes which use the simple interface names (eth0/wlan0 etc.) Dec 14, 2020 at 17:46

1 Answer 1


"Shared internet connection" isn't particularly well-defined. In principle you can "share" your "internet connection" just by enabling routing (if it isn't already enabled), and setting up the LAN connection on the "sharing PC" and the "other PC" manually. You don't even need NAT.

And then there are variants launching a WLAN access point, etc., etc.

That said, here's the script I use on my systemd- and Networkmanages-less Devuan system to NAT an interface, which may or may not be what you mean by "sharing the internet connection":


# masquerade $1 (e.g. eth0, ppp0) as $2 (default wlan0)



modprobe nf_conntrack
modprobe nf_conntrack_ipv4
modprobe nf_nat
modprobe iptable_nat  

echo "1" > /proc/sys/net/ipv4/ip_forward
echo "1" > /proc/sys/net/ipv4/ip_dynaddr

iptables -P INPUT ACCEPT
iptables -F INPUT
iptables -F OUTPUT 
iptables -P FORWARD DROP
iptables -F FORWARD 
iptables -t nat -F
iptables -A FORWARD -i $EXTIF -o $INTIF -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i $INTIF -o $EXTIF -j ACCEPT
iptables -t nat -A POSTROUTING -o $EXTIF -j MASQUERADE

Some things in this script aren't strictly necessary, but I find them convenient.

If I need to run a DHCP server, I mnaually start dhcpd, having set up the configuration file beforehand.

  • I appreciate your response. Just for the record, what I mean by sharing an internet connection in this context is to use a network interface that would normally consume internet connectivity (e.g. an ethernet port on a desktop) and make it instead provide connectivity for some other device by making use of another interface (a wireless interface or another ethernet port) which is already connected to the internet. The specific configuration I have in my head would involve NAT/masquerading. I just don't see what I could have missed to make my implementation fail to work. Dec 14, 2020 at 23:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .