Forward internet from eth0 to a repeater connected via eth1 and serve a captive portal

Question

Premise: a ranch/guesthouse in northern New Mexico wants to show their guests a splash page before allowing them on to an otherwise open network.

Currently, the internet comes through a modem and broadcasts itself via Eero beacons (eero.com), as it is a very large property.

I am trying to help them accomplish this goal and have succeeded at connecting a RPi3B+ to the modem and creating a WiFi access point that serves the splash page via NoDogSplash (followed the guides on pimylifeup: AP and Captive Portal) which is awesome.

However, this is not much help as the network doesn't reach the rest of the property, and we don't want to invest in additional wireless repeaters for this network if it can be avoided.

The Eero system can create a guest network, but no captive portal, and has two ethernet ports on the first "beacon" which Eero confirmed are both IN/OUT ports. In theory, the Eero is able to broadcast two networks in this way.

We have ordered a USB-ETH adapter and plugged it in. I tried renaming wlan0 in the PiMyLife up tutorial to eth1 (the interface that comes up in ifconfig), rebooting, flushing iptables and all that, but no internet is coming out of ETH1. The tutorial uses a combination of hostapd, some updates to dhcpcd.conf and dnsmasq along with an iptable rule to achieve the desired effect going from eth0 to wlan0.

After a ton of reading online, I am wondering the following:

am I going about this the correct way at all? Is it possible? Would it suffice to use DHCP and DNSMASQ to accomplish this somehow? do I need to reorient towards using a bridge? Is a bridge "smart" enough to serve a captive portal or is just a forwarding mechanism? based on this question, it sounds like the tutorial mentioned above can do what I need, but I do not understand what changes I need to make to utilize eth1 in place of wlan0. The author states: I've followed this [the pimylifeup article] which has got me to the point where a test laptop connected to eth1 is able to get an IP address via DHCP and browse remote web pages.

I also tried using this script but kept getting the error eth0|eth1 is not a WiFi interface so presumably that also requires a wireless interface to do it's thing...

Very confused at this stage, any advice or guidance is appreciated. It seems to me the advice given here might apply but I'm not totally sure how and if this would allow me to put a captive portal in between...

Answer 1

Managed to figure this out following these instructions to forward eth0 to eth1 on Stretch:

https://github.com/acuparse/acuparse/wiki/Installation-on-Raspberry-Pi

Bear in mind, this guide uses eth1 as the connection to router (ISP) and eth0 as the port going to the extender, so if you're set up is like mine, be sure to invert those whenever you see them!

Also, it didn't work at first so I then went back to the PiMyLifeUp guide and set the vital net.ipv4.ip_forward=1 in /etc/sysctl.conf! And sure enough the internet was forwarded to a laptop connected via eth1.

You can also ignore the section where they edit the /etc/hosts file

From there it was easy enough to setup NoDogSplash again, which had no trouble targeting the eth1 interface. The next gotcha was that the Eeros had to be set to Bridge mode. This disables its DHCP capabilities and passes them upstream, to the Pi in this case. This means that the home owner has a bit less to play with in their Eero app but that's acceptable. Eero still manages the network key, so we have a password protected network serving a captive portal. I've gone and whitelisted all the MACs that were already on the network and we're off!