How do I forward eth0 to wlan0?

Question

I tried to forward eth0 to wlan0 on my Raspberry Pi B+ using NAT on iptables with the following commands:

echo 1 > /proc/sys/net/ipv4/ip_forward iptables -A FORWARD --in-interface eth0 -j ACCEPT iptables --table nat -A POSTROUTING --out-interface wlan0 -j MASQUERADE

But it didn't work, when I tried to ping google.com I got ping: unknown host google.com on my laptop which is connected to the eth0 port on my Raspberry Pi B+. On my Raspberry Pi B+, I just have normal internet access from wlan0. The IP adresses on my wifi network are looking so: 192.168.1.xxx.

How do I forward eth0 to wlan0?

Answer 1

At least shown commands look correct. If this isn't a complete firewall configuration you've using on Raspberry Pi, i.e. if you have have other rules or have changed default forwarding policy (it is ACCEPT by default, changed with iptables -P), you also probably need to enable reply traffic, by adding state match:

iptables -I FORWARD 1 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

This will enable connection tracker to detect reply packets as belonging to the same connection originated on the inside interface and accept them.

I cant't remember for sure, if Raspberry Pi kernel hasn't enabled conntrack match, you have to use (old, deprecated) state extension instead:

iptables -I FORWARD 1 -m state --state ESTABLISHED,RELATED -j ACCEPT

You have to enter only one of these. I prefer to adding this as first rule in the chain.

The eth0 interface on Raspberry Pi and your computer behind it should have addresses from another network. For example, you can use 192.168.10.1/24 (or /255.255.255.0 which is the same) on RasPi and 192.168.10.2 on target host.

On the target host you set eth0 address of RasPi (192.168.10.1 in previous example) as the default gateway, and DNS servers to the same as set on your RasPi. You can inspect which servers RasPi uses by issuing on it: cat /etc/resolv.conf, and look to 'nameserver' entries. Or you can just set up google public DNS (8.8.8.8, 8.8.4.4).

Answer 2

iptables allows you to filter traffic, and set up the NAT translations as you've done, but it doesn't actually have anything to do with setting up your device as a router to forward traffic between two interfaces.  The only command that actually does anything related to that is the ip_forward one.  The rest is all down to your IP setup on both the Pi and your laptop. 

(to clarify, your second line does tell iptables to permit traffic coming in on eth0 and FORWARDed to anywhere but the Pi itself, but it doesn't actually permit traffic flowing the other way so its useless by itself, and it's only relevant if you've set iptables to drop all FORWARD traffic by default)

So if the Pi itself has internet access, the real questions you need to address are:

• what is the IP setup on the eth0 side of your network, does everything line up so your laptop can communicate normally with the Pi, and is your laptop using the Pi's eth0 address as a gateway?

• If you have changed iptables enough to default deny all FORWARD traffic and only the rules above are in effect, you rule above ensures packets can get out but no reply can get back, so what do you actually want iptables to filter?