I have a reasonably ordinary Linux machine with two ethernet interfaces which I'll call eth0 and eth1, and a WiFi interface which I'll call wlan0.
For various reasons, I do not want this machine to talk directly out over its WiFi interface. Instead, I want it to treat eth0 as its gateway to everything.
But then I'd like a router on this machine's LAN (that is, reachable via eth0) to be able to use this machine's WiFi interface as a bridge out to the rest of the world. My colleagues and I have the idea that the router can ship packets back to this machine on eth1, and this machine can forward them to wlan0. Similarly, any incoming packets on wlan0 will be sent immediately back out over eth1 for the local router to deal with.
We're pursuing this topology because we believe a dedicated router can make better routing decisions, and more easily, than if we tried to teach the Linux machine in question to be a proper router. (It's not straightforward, because the WiFi link is (a) not always up and (b) not the only link out to the rest of our world. Also (c) other hosts on this LAN may want to send packets over the WiFi link also, and (d) packets for those other hosts may arrive over it.)
I know there are a number of ways to route packets between two interfaces like this. I could use a bridge interface, or I could use iptables. For the moment I've been pursuing iptables. (The machine is a bit too old to use nft.)
What I'm not sure of is:
- whether eth1 and wlan0 need their own IP addresses and
- if they do, how hard I'll have to work to keep this machine from using them directly.
As a bare minimum I had imagined I could do something like
iptables -A FORWARD -i eth1 -o wlan0 -j ACCEPT
iptables -A FORWARD -i wlan0 -o eth1 -j ACCEPT
as in iptables forwarding between two interfaces. Notionally, this turns the Linux box into a wire between the two interfaces, blindly and bidirectionally forwarding all packets without inspecting or altering them in any way.
I'm afraid, though, that this may be naive, and not work, because it won't ARP right, and stuff.
I suspect I probably do need to assign IP addresses to eth1 and wlan0. And if I do that, I suspect I'll probably need to (at least) rewrite the source addresses of packets as I forward them. Per an answer at that question I linked to, that might be as easy as adding
iptables -t nat -A POSTROUTING -o wlan0 -j MASQUERADE
and maybe also
iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE
to my iptables recipe.
Also, if I do assign IP addresses to those two interfaces, I want to make sure the local Linux machine doesn't try to use them for anything else. I might need to create some explicit don't-route rules in the routing table, to force it to send everything out over eth0, even if it seems to match the subnets assigned to eth1 and/or wlan0.
Does anyone have any advice on how to make this work? (Or advice that it's a bad idea and will never work, I suppose, although I'm hoping it will.)
This is an isolated local network, by the way, not connected to the global Internet at all. Everything has fixed private-use addresses; there is no DHCP going on and no NATting required.