1

I am looking to find out exactly what steps must be taken to manually provision a shared internet connection on a workstation running a Linux based operating system.

I am aware that when using any Linux distribution which is configured to use systemd as it's init system with the NetworkManager service installed, one has the ability to configure a shared internet connection between two interfaces in an automated fashion (either with the system's native network settings or with a utility such as nm-connection-editor). It stands to reason that if one could observe the changes made to the system after configuring the shared internet connection using the automated method, one would possess the knowledge required to manually recreate it. With that in mind, here are the steps I've taken towards this and what I've discovered:

  1. The interface that's 'receiving' the shared connection is assigned the IP address 10.42.0.1 with a /24 sub-net mask by default

  2. dnsmasq is provisioned to provide DHCP and DNS services, listening on 10.42.0.1 by default.

    • DHCP offers IP addresses within the range of 10.42.0.2-10.42.0.254 and DNS points back to the primary resolver of the host interface
  3. The routing table is modified to include a route for the sub-net of the interface 'receiving' the shared connection. i.e. 10.42.0.0/24 dev enp1s0 proto kernel scope link src 10.42.0.1

  4. A series of ipv4/ipv6 related sysctl kernel parameters are changed. I dumped the relevant sysctl parameters before and after using the following bit of bash:

mybox ~ # sysctl -a | egrep "ipv4|ipv6" > sysctl_before

[ENABLE SHARED CONNECTION]

mybox ~ # sysctl -a | egrep "ipv4|ipv6" > sysctl_after

I then diffed the two files, which yielded the following:

6c6
< net.ipv4.conf.all.accept_redirects = 1
---
> net.ipv4.conf.all.accept_redirects = 0
20c20
< net.ipv4.conf.all.forwarding = 0
---
> net.ipv4.conf.all.forwarding = 1
52c52
< net.ipv4.conf.default.forwarding = 0
---
> net.ipv4.conf.default.forwarding = 1
84c84
< net.ipv4.conf.enp1s0.forwarding = 0
---
> net.ipv4.conf.enp1s0.forwarding = 1
116c116
< net.ipv4.conf.lo.forwarding = 0
---
> net.ipv4.conf.lo.forwarding = 1
148c148
< net.ipv4.conf.wlp2s0.forwarding = 0
---
> net.ipv4.conf.wlp2s0.forwarding = 1
185c185
< net.ipv4.ip_dynaddr = 0
---
> net.ipv4.ip_dynaddr = 1
187c187
< net.ipv4.ip_forward = 0
---
> net.ipv4.ip_forward = 1
381c381
< net.ipv6.conf.all.forwarding = 0
---
> net.ipv6.conf.all.forwarding = 1
431c431
< net.ipv6.conf.default.forwarding = 0
---
> net.ipv6.conf.default.forwarding = 1
481c481
< net.ipv6.conf.enp1s0.forwarding = 0
---
> net.ipv6.conf.enp1s0.forwarding = 1
531c531
< net.ipv6.conf.lo.forwarding = 0
---
> net.ipv6.conf.lo.forwarding = 1
581c581
< net.ipv6.conf.wlp2s0.forwarding = 0
---
> net.ipv6.conf.wlp2s0.forwarding = 1

I did the same thing for the filter and nat iptables rule-sets which yielded the following:

FILTER

3a4,12
> -A INPUT -i enp1s0 -p udp -m udp --dport 67 -j ACCEPT
> -A INPUT -i enp1s0 -p tcp -m tcp --dport 67 -j ACCEPT
> -A INPUT -i enp1s0 -p udp -m udp --dport 53 -j ACCEPT
> -A INPUT -i enp1s0 -p tcp -m tcp --dport 53 -j ACCEPT
> -A FORWARD -d 10.42.0.0/24 -o enp1s0 -m state --state RELATED,ESTABLISHED -j ACCEPT
> -A FORWARD -s 10.42.0.0/24 -i enp1s0 -j ACCEPT
> -A FORWARD -i enp1s0 -o enp1s0 -j ACCEPT
> -A FORWARD -o enp1s0 -j REJECT --reject-with icmp-port-unreachable
> -A FORWARD -i enp1s0 -j REJECT --reject-with icmp-port-unreachable

NAT

4a5
> -A POSTROUTING -s 10.42.0.0/24 ! -d 10.42.0.0/24 -j MASQUERADE

It doesn't appear that these changes alone are enough to produce a working shared internet connection, however, because reproducing them manually doesn't give me the glorious ping response from 8.8.8.8 I am desperately seeking.

For clarity's sake, I've also ensured that any clients making use of the shared connection have a default route in place that designates 10.42.0.1 as the default gateway.

Can anyone help me understand what it is that I am missing?

4
  • Did you also look at the routing tables? – muru Dec 14 '20 at 8:35
  • Yes, I included in the question the route that is added on the device sharing the internet connection and stated in the question that I made sure to include a route defining 10.42.0.1 as the default gateway on any clients. I'll edit the question to further clarify this. – apt-getschwifty Dec 14 '20 at 9:00
  • Ah. Yes, sorry I missed that. Is that output correct, though? It mentions eth0, and your iptables outputs use enp1s0. – muru Dec 14 '20 at 9:07
  • Yeah that's my bad, I used eth0 as an example because I have a few boxes which use the simple interface names (eth0/wlan0 etc.) – apt-getschwifty Dec 14 '20 at 17:46
0

"Shared internet connection" isn't particularly well-defined. In principle you can "share" your "internet connection" just by enabling routing (if it isn't already enabled), and setting up the LAN connection on the "sharing PC" and the "other PC" manually. You don't even need NAT.

And then there are variants launching a WLAN access point, etc., etc.

That said, here's the script I use on my systemd- and Networkmanages-less Devuan system to NAT an interface, which may or may not be what you mean by "sharing the internet connection":

#!/bin/bash

# masquerade $1 (e.g. eth0, ppp0) as $2 (default wlan0)

INTIF="$1"
EXTIF=${2:-wlan0}

echo $INTIF $EXTIF

modprobe nf_conntrack
modprobe nf_conntrack_ipv4
modprobe nf_nat
modprobe iptable_nat  

echo "1" > /proc/sys/net/ipv4/ip_forward
echo "1" > /proc/sys/net/ipv4/ip_dynaddr

iptables -P INPUT ACCEPT
iptables -F INPUT
iptables -P OUTPUT ACCEPT
iptables -F OUTPUT 
iptables -P FORWARD DROP
iptables -F FORWARD 
iptables -t nat -F
iptables -A FORWARD -i $EXTIF -o $INTIF -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i $INTIF -o $EXTIF -j ACCEPT
iptables -t nat -A POSTROUTING -o $EXTIF -j MASQUERADE

Some things in this script aren't strictly necessary, but I find them convenient.

If I need to run a DHCP server, I mnaually start dhcpd, having set up the configuration file beforehand.

1
  • I appreciate your response. Just for the record, what I mean by sharing an internet connection in this context is to use a network interface that would normally consume internet connectivity (e.g. an ethernet port on a desktop) and make it instead provide connectivity for some other device by making use of another interface (a wireless interface or another ethernet port) which is already connected to the internet. The specific configuration I have in my head would involve NAT/masquerading. I just don't see what I could have missed to make my implementation fail to work. – apt-getschwifty Dec 14 '20 at 23:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.