I am looking to find out exactly what steps must be taken to manually provision a shared internet connection on a workstation running a Linux based operating system.
I am aware that when using any Linux distribution which is configured to use systemd as it's init system with the NetworkManager service installed, one has the ability to configure a shared internet connection between two interfaces in an automated fashion (either with the system's native network settings or with a utility such as nm-connection-editor). It stands to reason that if one could observe the changes made to the system after configuring the shared internet connection using the automated method, one would possess the knowledge required to manually recreate it. With that in mind, here are the steps I've taken towards this and what I've discovered:
The interface that's 'receiving' the shared connection is assigned the IP address 10.42.0.1 with a /24 sub-net mask by default
dnsmasq is provisioned to provide DHCP and DNS services, listening on 10.42.0.1 by default.
- DHCP offers IP addresses within the range of 10.42.0.2-10.42.0.254 and DNS points back to the primary resolver of the host interface
The routing table is modified to include a route for the sub-net of the interface 'receiving' the shared connection. i.e. 10.42.0.0/24 dev enp1s0 proto kernel scope link src 10.42.0.1
A series of ipv4/ipv6 related sysctl kernel parameters are changed. I dumped the relevant sysctl parameters before and after using the following bit of bash:
mybox ~ # sysctl -a | egrep "ipv4|ipv6" > sysctl_before [ENABLE SHARED CONNECTION] mybox ~ # sysctl -a | egrep "ipv4|ipv6" > sysctl_after
I then diffed the two files, which yielded the following:
6c6 < net.ipv4.conf.all.accept_redirects = 1 --- > net.ipv4.conf.all.accept_redirects = 0 20c20 < net.ipv4.conf.all.forwarding = 0 --- > net.ipv4.conf.all.forwarding = 1 52c52 < net.ipv4.conf.default.forwarding = 0 --- > net.ipv4.conf.default.forwarding = 1 84c84 < net.ipv4.conf.enp1s0.forwarding = 0 --- > net.ipv4.conf.enp1s0.forwarding = 1 116c116 < net.ipv4.conf.lo.forwarding = 0 --- > net.ipv4.conf.lo.forwarding = 1 148c148 < net.ipv4.conf.wlp2s0.forwarding = 0 --- > net.ipv4.conf.wlp2s0.forwarding = 1 185c185 < net.ipv4.ip_dynaddr = 0 --- > net.ipv4.ip_dynaddr = 1 187c187 < net.ipv4.ip_forward = 0 --- > net.ipv4.ip_forward = 1 381c381 < net.ipv6.conf.all.forwarding = 0 --- > net.ipv6.conf.all.forwarding = 1 431c431 < net.ipv6.conf.default.forwarding = 0 --- > net.ipv6.conf.default.forwarding = 1 481c481 < net.ipv6.conf.enp1s0.forwarding = 0 --- > net.ipv6.conf.enp1s0.forwarding = 1 531c531 < net.ipv6.conf.lo.forwarding = 0 --- > net.ipv6.conf.lo.forwarding = 1 581c581 < net.ipv6.conf.wlp2s0.forwarding = 0 --- > net.ipv6.conf.wlp2s0.forwarding = 1
I did the same thing for the filter and nat iptables rule-sets which yielded the following:
3a4,12 > -A INPUT -i enp1s0 -p udp -m udp --dport 67 -j ACCEPT > -A INPUT -i enp1s0 -p tcp -m tcp --dport 67 -j ACCEPT > -A INPUT -i enp1s0 -p udp -m udp --dport 53 -j ACCEPT > -A INPUT -i enp1s0 -p tcp -m tcp --dport 53 -j ACCEPT > -A FORWARD -d 10.42.0.0/24 -o enp1s0 -m state --state RELATED,ESTABLISHED -j ACCEPT > -A FORWARD -s 10.42.0.0/24 -i enp1s0 -j ACCEPT > -A FORWARD -i enp1s0 -o enp1s0 -j ACCEPT > -A FORWARD -o enp1s0 -j REJECT --reject-with icmp-port-unreachable > -A FORWARD -i enp1s0 -j REJECT --reject-with icmp-port-unreachable
4a5 > -A POSTROUTING -s 10.42.0.0/24 ! -d 10.42.0.0/24 -j MASQUERADE
It doesn't appear that these changes alone are enough to produce a working shared internet connection, however, because reproducing them manually doesn't give me the glorious ping response from 188.8.131.52 I am desperately seeking.
For clarity's sake, I've also ensured that any clients making use of the shared connection have a default route in place that designates 10.42.0.1 as the default gateway.
Can anyone help me understand what it is that I am missing?