0

Objective:

I am working on an embedded Linux device with the following network configuration.

  • Interface-1: 'wlan0' acts as an access point.
  • Interface-2: 'eth1' connected to Internet.

My objective is to NAT packets reaching 'wlan0' (and destined to IP's other than those in the subnet of wlan0) from the wireless clients connected to it to 'eth1'. So that the wireless clients connected to 'wlan0' will have Internet access.

Solution tried:

I went through few links (unfortunately I missed the references) which proposed the following solution using iptables.

EXTIF="eth1"
INTIF="wlan0"

        echo "1" > /proc/sys/net/ipv4/ip_forward
        echo "1" > /proc/sys/net/ipv4/ip_dynaddr

        $IPTABLES -P INPUT ACCEPT
        $IPTABLES -F INPUT
        $IPTABLES -P OUTPUT ACCEPT
        $IPTABLES -F OUTPUT
        $IPTABLES -P FORWARD DROP
        $IPTABLES -F FORWARD
        $IPTABLES -t nat -F

        route add -net 192.168.10.0/24 dev $INTIF

        $IPTABLES -A FORWARD -i $EXTIF -o $INTIF -m state --state ESTABLISHED,RELATED -j ACCEPT
        $IPTABLES -A FORWARD -i $INTIF -o $EXTIF -j ACCEPT
        #$IPTABLES -A FORWARD -j LOG
    #Puzzled, how will the matching condition of `-o $EXTIF` be satisfied for any packets???

        echo "   Enabling SNAT (MASQUERADE) functionality on $EXTIF"
        $IPTABLES -t nat -A POSTROUTING -o $EXTIF -j MASQUERADE

I am bit new to `iptables` so have the  following clarifications

Clarifications required:

  1. As I understand a packet will be traversing the FORWARD chain only if it is not intended for the local host.
  2. The clarification I have is how will the matching condition of -o $EXTIF be satisfied for any packets. I understand that -i $INTIF will be satisfied as it is the entry interface for the packet.

2 Answers 2

1

As I understand a packet will be traversing the FORWARD chain only if it is not intended for the local host.

Correct.

The clarification I have is how will the matching condition of -o $EXTIF be satisfied for any packets. I understand that -i $INTIF will be satisfied as it is the entry interface for the packet.

By the time the packet hits the "forward" chain the routing descision (including the descision on whether the accept the packet locally or send it onwards) has been made. So the output interface is known and can be matched against in rules.

0

-o $EXTIF will be satisfied because it is your egress interface for everything except your LAN. In other words the Internet. So as your LAN tries to reach some site on the Internet, it will traverse $INTIF and exit $EXTIF.

Not the answer you're looking for? Browse other questions tagged or ask your own question.