I have a reasonably ordinary Linux machine with two ethernet interfaces which I'll call eth0 and eth1, and a WiFi interface which I'll call wlan0.

For various reasons, I do not want this machine to talk directly out over its WiFi interface. Instead, I want it to treat eth0 as its gateway to everything.

But then I'd like a router on this machine's LAN (that is, reachable via eth0) to be able to use this machine's WiFi interface as a bridge out to the rest of the world. My colleagues and I have the idea that the router can ship packets back to this machine on eth1, and this machine can forward them to wlan0. Similarly, any incoming packets on wlan0 will be sent immediately back out over eth1 for the local router to deal with.

We're pursuing this topology because we believe a dedicated router can make better routing decisions, and more easily, than if we tried to teach the Linux machine in question to be a proper router. (It's not straightforward, because the WiFi link is (a) not always up and (b) not the only link out to the rest of our world. Also (c) other hosts on this LAN may want to send packets over the WiFi link also, and (d) packets for those other hosts may arrive over it.)

I know there are a number of ways to route packets between two interfaces like this. I could use a bridge interface, or I could use iptables. For the moment I've been pursuing iptables. (The machine is a bit too old to use nft.)

What I'm not sure of is:

  1. whether eth1 and wlan0 need their own IP addresses and
  2. if they do, how hard I'll have to work to keep this machine from using them directly.

As a bare minimum I had imagined I could do something like

iptables -A FORWARD -i eth1 -o wlan0 -j ACCEPT
iptables -A FORWARD -i wlan0 -o eth1 -j ACCEPT

as in iptables forwarding between two interfaces. Notionally, this turns the Linux box into a wire between the two interfaces, blindly and bidirectionally forwarding all packets without inspecting or altering them in any way.

I'm afraid, though, that this may be naive, and not work, because it won't ARP right, and stuff.

I suspect I probably do need to assign IP addresses to eth1 and wlan0. And if I do that, I suspect I'll probably need to (at least) rewrite the source addresses of packets as I forward them. Per an answer at that question I linked to, that might be as easy as adding

iptables -t nat -A POSTROUTING -o wlan0 -j MASQUERADE

and maybe also

iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE

to my iptables recipe.

Also, if I do assign IP addresses to those two interfaces, I want to make sure the local Linux machine doesn't try to use them for anything else. I might need to create some explicit don't-route rules in the routing table, to force it to send everything out over eth0, even if it seems to match the subnets assigned to eth1 and/or wlan0.

Does anyone have any advice on how to make this work? (Or advice that it's a bad idea and will never work, I suppose, although I'm hoping it will.)

This is an isolated local network, by the way, not connected to the global Internet at all. Everything has fixed private-use addresses; there is no DHCP going on and no NATting required.

  • Could you please draw a diagram of how is everything connected? System has three NICs, eth0, eth1, wlan0; what's behind each NIC and why it needs to forward packets? For whom? Commented Jan 20, 2023 at 8:48

1 Answer 1


If I understand correctly, you basically want that NUC to function as a switch between your eth1 and wlan0? If so, you can create a network bridge with iproute2 (ip link add type bridge ...) or with bridge-utils (brctl addbr ...) and add the two interfaces. It's not required to assign an IP addresses on those interfaces. In that case, your eth0 will be the only interface with an IP address and will just work as if it was the only active network interface.

  • I don't know what "NUC" is, but yes, I want to bridge eth1 and wlan0 as if there were a wire between them (is that what you meant by "function as a switch between"?). I don't seem to have the brctl command — is that something in the bridge-utils package? I don't know what iproute2 is, or where I would try that ip link add … syntax. (But thanks for these leads!) Commented Jan 20, 2023 at 0:49
  • Looks like ebtables might be Yet Another possibility. Commented Jan 20, 2023 at 1:27
  • NUC is a Next Unit of Compute, basically a small PC from Intel. Somewhere aloung the way I somehow thought you were running a NUC :p Anyway, replace NUC is "the PC". Commented Jan 20, 2023 at 7:34
  • As for brctl, it is indeed part of the bridge-utils package, and iproute2 contains the ip command. You can typically install them though apt, yum or whatever package manager you're using. You should find plenty of examples online on how to create a bridge between 2 interfaces using those utilities. Commented Jan 20, 2023 at 7:37
  • 1
    Because 802.11 (WiFi) packet format has no usable provision for that. It only has a place for three MAC addresses: STA, AP and anything behind AP. STA authenticates to AP with its MAC address and if it tries to send anything with another address such packet will be rejected by the AP as not authentic. So only AP is able to bridge wireless networks. There is another, 4-address packet format, but it's not standardised fully and therefore unusable. Commented Jan 20, 2023 at 17:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .