What steps must be taken to manually setup a shared internet connection?

Question

I am looking to find out exactly what steps must be taken to manually provision a shared internet connection on a workstation running a Linux based operating system.

I am aware that when using any Linux distribution which is configured to use systemd as it's init system with the NetworkManager service installed, one has the ability to configure a shared internet connection between two interfaces in an automated fashion (either with the system's native network settings or with a utility such as nm-connection-editor). It stands to reason that if one could observe the changes made to the system after configuring the shared internet connection using the automated method, one would possess the knowledge required to manually recreate it. With that in mind, here are the steps I've taken towards this and what I've discovered:

1. The interface that's 'receiving' the shared connection is assigned the IP address 10.42.0.1 with a /24 sub-net mask by default

2. dnsmasq is provisioned to provide DHCP and DNS services, listening on 10.42.0.1 by default.

   • DHCP offers IP addresses within the range of 10.42.0.2-10.42.0.254 and DNS points back to the primary resolver of the host interface

3. The routing table is modified to include a route for the sub-net of the interface 'receiving' the shared connection. i.e. 10.42.0.0/24 dev enp1s0 proto kernel scope link src 10.42.0.1

4. A series of ipv4/ipv6 related sysctl kernel parameters are changed. I dumped the relevant sysctl parameters before and after using the following bit of bash:

mybox ~ # sysctl -a | egrep "ipv4|ipv6" > sysctl_before

[ENABLE SHARED CONNECTION]

mybox ~ # sysctl -a | egrep "ipv4|ipv6" > sysctl_after

I then diffed the two files, which yielded the following:

6c6
< net.ipv4.conf.all.accept_redirects = 1
---
> net.ipv4.conf.all.accept_redirects = 0
20c20
< net.ipv4.conf.all.forwarding = 0
---
> net.ipv4.conf.all.forwarding = 1
52c52
< net.ipv4.conf.default.forwarding = 0
---
> net.ipv4.conf.default.forwarding = 1
84c84
< net.ipv4.conf.enp1s0.forwarding = 0
---
> net.ipv4.conf.enp1s0.forwarding = 1
116c116
< net.ipv4.conf.lo.forwarding = 0
---
> net.ipv4.conf.lo.forwarding = 1
148c148
< net.ipv4.conf.wlp2s0.forwarding = 0
---
> net.ipv4.conf.wlp2s0.forwarding = 1
185c185
< net.ipv4.ip_dynaddr = 0
---
> net.ipv4.ip_dynaddr = 1
187c187
< net.ipv4.ip_forward = 0
---
> net.ipv4.ip_forward = 1
381c381
< net.ipv6.conf.all.forwarding = 0
---
> net.ipv6.conf.all.forwarding = 1
431c431
< net.ipv6.conf.default.forwarding = 0
---
> net.ipv6.conf.default.forwarding = 1
481c481
< net.ipv6.conf.enp1s0.forwarding = 0
---
> net.ipv6.conf.enp1s0.forwarding = 1
531c531
< net.ipv6.conf.lo.forwarding = 0
---
> net.ipv6.conf.lo.forwarding = 1
581c581
< net.ipv6.conf.wlp2s0.forwarding = 0
---
> net.ipv6.conf.wlp2s0.forwarding = 1

I did the same thing for the filter and nat iptables rule-sets which yielded the following:

FILTER

3a4,12
> -A INPUT -i enp1s0 -p udp -m udp --dport 67 -j ACCEPT
> -A INPUT -i enp1s0 -p tcp -m tcp --dport 67 -j ACCEPT
> -A INPUT -i enp1s0 -p udp -m udp --dport 53 -j ACCEPT
> -A INPUT -i enp1s0 -p tcp -m tcp --dport 53 -j ACCEPT
> -A FORWARD -d 10.42.0.0/24 -o enp1s0 -m state --state RELATED,ESTABLISHED -j ACCEPT
> -A FORWARD -s 10.42.0.0/24 -i enp1s0 -j ACCEPT
> -A FORWARD -i enp1s0 -o enp1s0 -j ACCEPT
> -A FORWARD -o enp1s0 -j REJECT --reject-with icmp-port-unreachable
> -A FORWARD -i enp1s0 -j REJECT --reject-with icmp-port-unreachable

NAT

4a5
> -A POSTROUTING -s 10.42.0.0/24 ! -d 10.42.0.0/24 -j MASQUERADE

It doesn't appear that these changes alone are enough to produce a working shared internet connection, however, because reproducing them manually doesn't give me the glorious ping response from 8.8.8.8 I am desperately seeking.

For clarity's sake, I've also ensured that any clients making use of the shared connection have a default route in place that designates 10.42.0.1 as the default gateway.

Can anyone help me understand what it is that I am missing?

Answer 1

"Shared internet connection" isn't particularly well-defined. In principle you can "share" your "internet connection" just by enabling routing (if it isn't already enabled), and setting up the LAN connection on the "sharing PC" and the "other PC" manually. You don't even need NAT.

And then there are variants launching a WLAN access point, etc., etc.

That said, here's the script I use on my systemd- and Networkmanages-less Devuan system to NAT an interface, which may or may not be what you mean by "sharing the internet connection":

#!/bin/bash

# masquerade $1 (e.g. eth0, ppp0) as $2 (default wlan0)

INTIF="$1"
EXTIF=${2:-wlan0}

echo $INTIF $EXTIF

modprobe nf_conntrack
modprobe nf_conntrack_ipv4
modprobe nf_nat
modprobe iptable_nat  

echo "1" > /proc/sys/net/ipv4/ip_forward
echo "1" > /proc/sys/net/ipv4/ip_dynaddr

iptables -P INPUT ACCEPT
iptables -F INPUT
iptables -P OUTPUT ACCEPT
iptables -F OUTPUT 
iptables -P FORWARD DROP
iptables -F FORWARD 
iptables -t nat -F
iptables -A FORWARD -i $EXTIF -o $INTIF -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i $INTIF -o $EXTIF -j ACCEPT
iptables -t nat -A POSTROUTING -o $EXTIF -j MASQUERADE

Some things in this script aren't strictly necessary, but I find them convenient.

If I need to run a DHCP server, I mnaually start dhcpd, having set up the configuration file beforehand.