Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

My PC is equipped with two net interfaces - wlan0 and eth0. I want to use WiFi port as access point on wlan0. So i use hostapd facility and it works properly in routing mode in local network. Users can connect to such created access point and DHCP works properly in both segments. The PC with hostapd does not have any firewalls and/or iptables rules (iptables and firewalls disabled). I want to only use firewall build in to the ADSL router.

My net config is as follows

......PC with hostapd.................cable connection..................ADSL router

.....wlan0..............eth0..... <------------------------------>...........192.168.0.1......................<---> internet 192.168.10.1...192.168.0.7..............................added static routing to 192.168.10.X

ifconfig on PC:

eth0      Link encap:Ethernet  HWaddr 00:12:3F:F2:31:65  
       inet addr:192.168.0.7  Bcast:192.168.0.255  Mask:255.255.255.0
          inet6 addr: fe80::212:3fff:fef2:3165/64 Scope:Link
      UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
      RX packets:2169539 errors:0 dropped:0 overruns:0 frame:0
      TX packets:1008097 errors:0 dropped:0 overruns:0 carrier:0
      collisions:0 txqueuelen:1000 
      RX bytes:3056198487 (2.8 GiB)  TX bytes:72727161 (69.3 MiB)
      Interrupt:16 

lo        Link encap:Local Loopback  
      inet addr:127.0.0.1  Mask:255.0.0.0
      inet6 addr: ::1/128 Scope:Host
      UP LOOPBACK RUNNING  MTU:65536  Metric:1
      RX packets:3398 errors:0 dropped:0 overruns:0 frame:0
      TX packets:3398 errors:0 dropped:0 overruns:0 carrier:0
      collisions:0 txqueuelen:0 
      RX bytes:495444 (483.8 KiB)  TX bytes:495444 (483.8 KiB)

mon.wlan0 Link encap:UNSPEC  HWaddr 00-14-A5-04-94-3C-90-F0-00-00-00-00-00-00-00-00  
      UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
      RX packets:151 errors:0 dropped:0 overruns:0 frame:0
      TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
      collisions:0 txqueuelen:1000 
      RX bytes:17092 (16.6 KiB)  TX bytes:0 (0.0 b)

wlan0     Link encap:Ethernet  HWaddr 00:14:A5:04:94:3C  
      inet addr:192.168.10.1  Bcast:192.168.10.255  Mask:255.255.255.0
      inet6 addr: fe80::214:a5ff:fe04:943c/64 Scope:Link
      UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
      RX packets:0 errors:0 dropped:0 overruns:0 frame:0
      TX packets:1502 errors:0 dropped:0 overruns:0 carrier:0
      collisions:0 txqueuelen:1000 
      RX bytes:0 (0.0 b)  TX bytes:279392 (272.8 KiB)

I am totally noob in iptables. So can anybody help me to configure simple NAT iptables config to it on PC? I want all users connected to network via hostapd (network 192.168.10.X) to have access to and from internet? I dont want to filter any traffic, just only NAT.


OK, THX. But I can not get connection to Internet from WiFi segment. The client connected to WiFi has address 192.168.10.48 (via DHCP). The inly traffic I can notice on eth0 port from this address is

16:50:14.671587 ARP, Request who-has 192.168.0.48 tell 192.168.0.1, length 46

Notice - the address is 192.168.0.48 not 192.168.10.48. So Masquerade seams to work.

Eaven I can not ping to 192.168.0.1 - the port of ADSL router. It was possible before.

And what about access from internet to WIFI Users? Of course I will setup in ADSL router, forwarding particular IP port pooling from Internet to particular IP address of such WiFi user.

EDIT

systemstl shows that iptables is:

iptables.service          loaded active exited

But of course i run:

systemctl enable iptables.service
systemctl start iptables.service

EDIT

Works! But I have to add manually each time i boot computer (from startup script):

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

Is it normal situation?

share|improve this question

migrated from serverfault.com Jul 7 '13 at 16:49

This question came from our site for professional system and network administrators.

    
See my updated response below... –  MLu Jul 8 '13 at 3:14
add comment

1 Answer 1

In the simplest form:

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

That will allow all WiFi users access to the Internet.

Of course assuming your other routing setup is already done, namely:

  1. Forwarding enabled in the kernel

    sysctl net.ipv4.ip_forward=1
    
  2. Forwarding enabled in iptables:

    iptables -P FORWARD ACCEPT
    iptables -F FORWARD
    

Use tcpdump -nn -i eth0 to watch the traffic on eth0 in case of problems to see if it gets NATed properly, if the response is coming back, etc.

EDIT: "I have to add manually each time i boot computer (from startup script)..." It depends on what Linux distribution you have. Sadly pretty much each distro has its own Firewall tool - in the end they're only calling iptables but for some reason the authors believe that obfuscating the way iptables work is what the users want.

To answer your question - the most likely your firewall can be configured to add this NAT rule automatically. The exact way however varies between Linux distros for no good reason. Sad but true.

share|improve this answer
    
All firewalls on PC are disabled. The only running service is iptables –  user180586 Jul 8 '13 at 7:00
    
iptables == firewall -- Somehow you need to configure iptables to emit that MASQUERADE rule. How? It depends on your linux distribution. There must be config file somewhere. Where? It depends on your linux distribution. –  MLu Jul 9 '13 at 3:47
    
So You have mu iptables ruled: –  user180586 Jul 9 '13 at 7:10
    
So You have mu iptables ruled: [root@media ~]# iptables -L Chain INPUT (policy ACCEPT) target prot opt source destination Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination. And I and such line in startup : iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE. So my implementation of iptables is de facto "transparent" firewall - or no-firewall –  user180586 Jul 9 '13 at 7:19
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.