Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

The problem: the computers [Xbox 360 and a Kubuntu 12.04.1 laptop] can't access Internet through a recently-installed desktopless Debian 6 laptop (which is wirelessly connected to a WLAN station) but addresses are successfully given by dnsmasq.

The attempts:

1.1) /etc/dnsmaq.conf conffed according to http://wiki.debian.org/HowTo/dnsmasq: add lines


1.2) Follow http://www.cyberciti.biz/faq/rhel-fedora-linux-internet-connection-sharing-howto/ and use their script to setup iptables.

2) Follow the Ubuntu Internet Gateway Method (iptables) at https://help.ubuntu.com/community/Internet/ConnectionSharing recommended and which worked at Share internet in Linux.

The Debian laptop was rebooted many times and between each attempt, with and without the script auto-executing via /etc/rc.local.

While adding the iptables-restore command to that file I disabled the script.


Gateway is pingable and averages 39ms.

iptables -nvL with attempt #2 in effect, direct writing from the laptop's monitor after executing:

Chain INPUT (policy ACCEPT 179 packets, 26088 bytes)
 pkts bytes target     prot opt in     out     source                  destination

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source                  destination
    0     0 ACCEPT     all  --  wlan0  eth0
         ctstate NEW
    0     0 ACCEPT     all  --  *      *     
         ctstate RELATED,ESTABLISHED

Chain OUTPUT (policy ACCEPT 88 packets, 10716 bytes)
 pkts bytes target     prot opt in     out     source                  destination

EDIT 2: iptables -t nat -nvL:

Chain PREROUTING (policy ACCEPT 232 packets, 56438 bytes)
 pkts bytes target     prot opt in     out     source                  destination

Chain POSTROUTING (policy ACCEPT 60 packets, 4059 bytes)
 pkts bytes target     prot opt in     out     source                  destination

    4  1032 MASQUERADE  all  --  *      eth0     

Chain OUTPUT (policy ACCEPT 64 packets, 5091 bytes)
 pkts bytes target     prot opt in     out     source                  destination

EDIT 3: I tried https://www.debian-administration.org/articles/23 by telling /etc/rc.local to run it, and it alone, but still exactly same problem. This time I switched eth1 with wlan0.

share|improve this question
Please show your actual ruleset (output of iptables -nvL). –  Ansgar Wiechers Sep 13 '12 at 9:36
Can they ping the gateway? –  David Schwartz Sep 13 '12 at 9:48
@DavidSchwartz: Yes the gateway is pingable. –  rautamiekka Sep 13 '12 at 9:53
@AnsgarWiechers: Added to post. –  rautamiekka Sep 13 '12 at 10:04
@AnsgarWiechers this prints the regular tables, not the NAT tables. @Rautamiekka, please provide the output of iptables -t nat -nvL. –  gertvdijk Sep 13 '12 at 12:55

1 Answer 1

It seems you've set the wrong interface to perform MASQUERADE for. You state you want to 'share' the internet connection of the laptop provided by a wireless connection (probably wlan0 on your machine) to a wired connection (seems to be eth0 on your machine). However, your POSTROUTING chain rule is configured for eth0 instead of wlan0 (thev value in the out column is relevant here).

Try changing the script you mention to read like this:

# set wan interface such as eth1 or ppp0

It then uses that interface to set your iptabels rule correctly in these lines:

echo "Setting ${SHARE_IF} as router interface..."
$IPT --table nat --append POSTROUTING --out-interface ${SHARE_IF} -j MASQUERADE
share|improve this answer
Replied to your comment on the OP. –  rautamiekka Sep 13 '12 at 14:27
@Rautamiekka: and I've just extended my answer to point you to the line in your script that I think should be checked and changed. –  gertvdijk Sep 13 '12 at 14:47
You know a bit more than me, so which of those attempted instructions are more worky ? By this answer you seem to favor the first one. Indeed, I failed with setting the WAN interface in the script. –  rautamiekka Sep 13 '12 at 17:11
@Rautamiekka: Which attempted instructions do you mean? I think I suggest exactly one: "Try..." –  gertvdijk Sep 13 '12 at 17:15
You're pointing at the 1.2. –  rautamiekka Sep 13 '12 at 17:42

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.