Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I would like to use my ubuntu 12.04 notebook as a wifi hotsport to my smatphone. Everything is going ok, using dnsmasq and hostapd and allowing ports 68 and 53 on UFW. But to access the web the UFW must be disabled. The connection is ok (wifi is connected, IP properly received, dns query forwarded...) In the UFW full log I see:

Oct  3 17:09:41 ccd-7840l kernel: [28302.397796] [UFW AUDIT] IN=wlan1 OUT=eth8 MAC=8c:...:00 SRC=192.168.0.59 DST=74.125.234.196 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=22391 DF PROTO=TCP SPT=46279 DPT=443 WINDOW=14600 RES=0x00 SYN URGP=0 
Oct  3 17:09:41 ccd-7840l kernel: [28302.397841] [UFW BLOCK] IN=wlan1 OUT=eth8 MAC=8c:...:00 SRC=192.168.0.59 DST=74.125.234.196 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=22391 DF PROTO=TCP SPT=46279 DPT=443 WINDOW=14600 RES=0x00 SYN URGP=0

Then, I've added the following rules:

sudo ufw allow from 192.168.0.59
sudo ufw allow in on wlan1 from  192.168.0.48/28

But it is still blocking. I don't know what to search for on google to fix this :)

share|improve this question

migrated from serverfault.com Oct 3 '13 at 20:17

This question came from our site for professional system and network administrators.

add comment

1 Answer 1

up vote 0 down vote accepted

This solution worked for me.

First, packet forwarding needs to be enabled in ufw. Two configuration files will need to be adjusted, in /etc/default/ufw change the DEFAULT_FORWARD_POLICY to “ACCEPT”:

DEFAULT_FORWARD_POLICY="ACCEPT"

Then edit /etc/ufw/sysctl.conf and uncomment: (I guess your script for starting virtual hotspot already does set IP Forwarding. So you can skip this step. or may want to remove IP forwarding line from your script.)

net/ipv4/ip_forward=1

Similarly, for IPv6 forwarding uncomment:

net/ipv6/conf/default/forwarding=1

Now we will add rules to the /etc/ufw/before.rules file. The default rules only configure the filter table, and to enable masquerading the nat table will need to be configured. Add the following to the top of the file just after the header comments: (Again if you have script that you use to start your hotspot, you can, or probably should remove any lines relating to masqueradaing from there.)

># nat Table rules
>*nat
>:POSTROUTING ACCEPT [0:0]

># Forward traffic through eth8.
>-A POSTROUTING -s 192.168.0.0/24 -o eth8 -j MASQUERADE

># don't delete the 'COMMIT' line or these nat table rules won't be processed
>COMMIT

The comments are not strictly necessary, but it is considered good practice to document your configuration. Also, when modifying any of the rules files in /etc/ufw, make sure these lines are the last line for each table modified:

# don't delete the 'COMMIT' line or these rules won't be processed
COMMIT

For each Table a corresponding COMMIT statement is required. In these examples only the nat and filter tables are shown, but you can also add rules for the raw and mangle tables. [Note]

In the above example replace eth8, and 192.168.0.0/24 with the appropriate interfaces and IP range for your network.

Finally, disable and re-enable ufw to apply the changes:

sudo ufw disable && sudo ufw enable

IP Masquerading should now be enabled. You can also add any additional FORWARD rules to the /etc/ufw/before.rules. It is recommended that these additional rules be added to the ufw-before-forward chain.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.