I have 3 Raspberry, of which one to use as a firewall with iptables, connected to others via switch.

Internet--> A (firewall) --> (switch) --> B 
                                      \-> C

I would like all the traffic directed to the other raspberries (B-C) to pass through the firewall A first. Now: I realized that once the traffic reaches the firewall, I can redirect it to others Raspb via NAT iptables. But my doubt is: how to make the traffic, before reaching the raspberries B and C to their IP, pass through the Firewall first? The only solution I found is the one in which only the IP of the firewall appears externally and based on the ports to which it is contacted it is forwarded to the other Raspbs. My other doubt: should B and C be connected to the Internet with their IP, or should only a local IP visible to the Firewall be visible? Sorry for too many questions but I am approaching the world of networks recently.

EDIT: I noticed that all devices connected to my ISP's modem have the same public IP 85.X.X.56 My Switch is Tp Link TL-SG105E and supports both Port Based VLAN and 802.1Q VLAN. I don't know if it supports Trunked VLAN, I don't understand much about networks :(

  • How many public IP addresses did you get from your internet service provider? Just one? Or a subnet? If you don't know the answer then almost certainly you only got 1 address.
    – user643011
    Apr 24, 2019 at 20:19
  • 2nd question: how are you connected to the internet? 3rd question: if you got a modem from your ISP, is your ISP running a DHCP service, so that the modem will assign a public IP address to the first device that asks for one? 4th question: does your switch support VLAN? If so, does it also support trunked ports?
    – user643011
    Apr 24, 2019 at 20:26
  • 1
    You're right, I have edit and added new information about this
    – Giupo
    Apr 24, 2019 at 21:11

1 Answer 1


Since you only have 1 IP address you need to have NAT for all raspberries B-C. Only Raspberry A will get IP from your ISP.

Since your devices would get the same IP from ISP you need to separate the public network from the private one.

Your Raspberry Pi only has one network connection. You could use VLAN trunked port to work around this, but since your switch is small (5 ports only) and you are inexperienced I suggest you do not use this.

Instead buy a cheap 15 Dollar/Euro USB-Ethernet adapter for raspberry A so you can connect two Ethernet cables. E.g. https://www.amazon.com/s?k=usb+ethernet&ref=nb_sb_noss_2

Connect like this: Internet-Modem --> cheap 15 dollar usb-ethernet --> A (firewall/router/iptables/NAT) -> Raspberry A built-in Ethernet port --> (switch) --> B,C

Your Raspberry PI will get a public IP address from your ISP modem on the cheap usb connection, which is plugged into your internet modem. Do not plug your internet modem into the switch. Then use the firewall/routing/iptables function to provide internet to the B,C devices on the regular ethernet port. Plug that into the switch. Run a DHCP server on the raspberry pi on the regular Ethernet port connected to the switch. Make sure that the DHCP server announces the private IP address of the Raspberry A's regular ethernet port to the clients as default gateway.

Hope this helps!

  • Can you accept the answer?
    – user643011
    Apr 25, 2019 at 8:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.