1

It's time to ask the pro's, as I have read all of the answered questions, tried numerous suggestions for related questions on the forums and I cannot seem to get this right.

Question: How to allow users from "wlan0" to connect to the internet on "eth0"?

The system has three nic cards. Two wireless "wlan0" and "wlan1" and one LAN "eth0". The end goal is to have "wlan1" be part of a mesh network which has a node somewhere connected to the internet, "wlan0" to host local users, and eth0 to be an optional wired pipe also to the internet. Each interface must have it's own subnet. For the sake of simplicity lets drop the mesh part on "wlan1" for now, and focus only on getting two different subnets "wlan0" and "eth0" to talk to each other.

As it stands today. The ssid beacon broadcasts as expected, users are asked for the passkey, DHCP assigns an ip address in the expected range, but there is no internet connection.

Here are all the configuration files that I have touched.

/etc/network/interfaces:

# The loopback network interface
auto lo
iface lo inet loopback

# Wired LAN
allow-hotplug eth0
iface eth0 inet dhcp

# Wireless Users
allow-hotplug wlan0
iface wlan0 inet static
    address 192.168.2.100
    netmask 255.255.255.0
    gateway 192.168.2.254

/etc/default/hostapd:

DAEMON_CONF="/etc/hostapd/hostapd.conf"

/etc/hostapd/hostapd.conf:

interface=wlan0
driver=nl80211
country_code=US
ssid=YYYYYYYY
hw_mode=g
channel=6
wpa=2
wpa_passphrase=XXXXXXXX

/etc/sysctl.conf:

net.ipv4.ip_forward=1
net.ipv4.conf.all.forwarding=1
net.ipv6.conf.all.forwarding=1

/etc/default/isc-dhcp-server:

INTERFACES="wlan0"

/etc/dhcp/dhcpd.conf

ddns-update-style none;
option domain-name "unixmen.local";
option domain-name-servers server.unixmen.local;
default-lease-time 600;
max-lease-time 7200;
authoritative;
log-facility local7;

subnet 192.168.2.0 netmask 255.255.255.0 {
  range 192.168.2.2 192.168.2.51;
  option subnet-mask 255.255.255.0;
  option routers 192.168.2.254;
  option broadcast-address 192.168.2.255;
}

/etc/rc.local:

#!/bin/sh -e
#
# rc.local
#
# This script is executed at the end of each multiuser runlevel.
# Make sure that the script will "exit 0" on success or any other
# value on error.
#
# In order to enable or disable this script just change the execution
# bits.
#
# By default this script does nothing.

#!/bin/sh

PATH=/usr/sbin:/sbin:/bin:/usr/bin

#
# delete all existing rules.
#
iptables -F
iptables -t nat -F
iptables -t mangle -F
iptables -X

# Always accept loopback traffic
iptables -A INPUT -i lo -j ACCEPT

# Allow established connections, and those not coming from the outside
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -m state --state NEW ! -i wlan0 -j ACCEPT
iptables -A FORWARD -i wlan0 -o eth0 -m state --state ESTABLISHED,RELATED -j     ACCEPT
iptables -I FORWARD -i eth0 -o wlan0 -s 192.168.1.0/24 -d 192.168.2.0/24 -j ACCEPT
iptables -I FORWARD -i wlan0 -o eth0 -s 192.168.2.0/24 -d 192.168.1.0/24 -j ACCEPT

# Allow outgoing connections from the LAN side.
iptables -A FORWARD -i eth0 -o wlan0 -j ACCEPT

# Masquerade.
iptables -t nat -A POSTROUTING -o wlan0 -j MASQUERADE

# Don't forward from the outside to the inside.
iptables -A FORWARD -i wlan0 -o wlan0 -j REJECT

# Drop outside traffic except ssh
iptables -A INPUT -p tcp --dport ssh -j ACCEPT -i wlan0
iptables -A INPUT -j DROP -p tcp -i wlan0

# Enable routing.
echo 1 > /proc/sys/net/ipv4/ip_forward

exit 0

#ip route show

default via 192.168.1.1 dev eth0
192.168.1.0/24 dev eth0  proto kernel  scope link  src 192.168.1.3
192.168.2.0/24 dev wlan0  proto kernel  scope link  src 192.168.2.100

#route

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use     Iface
0.0.0.0         192.168.1.1     0.0.0.0         UG    0      0        0 eth0
192.168.1.0     0.0.0.0         255.255.255.0   U     0      0        0 eth0
192.168.2.0     0.0.0.0         255.255.255.0   U     0      0        0 wlan0

#iptables -nvL

Chain INPUT (policy DROP 49 packets, 7973 bytes)
 pkts bytes target     prot opt in     out     source               destination
  803 69528 f2b-sshd   tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            multiport dports 22
   47  3384 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0
  820 71137 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED
  122 12775 ACCEPT     all  --  !wlan0 *       0.0.0.0/0            0.0.0.0/0            state NEW
    0     0 ACCEPT     tcp  --  wlan0  *       0.0.0.0/0            0.0.0.0/0            tcp dpt:22
    0     0 DROP       tcp  --  wlan0  *       0.0.0.0/0            0.0.0.0/0

Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     all  --  wlan0  eth0    192.168.2.0/24       192.168.1.0/24
    0     0 ACCEPT     all  --  eth0   wlan0   192.168.1.0/24       192.168.2.0/24
    0     0 ACCEPT     all  --  wlan0  eth0    0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED
    0     0 ACCEPT     all  --  eth0   wlan0   0.0.0.0/0            0.0.0.0/0
    0     0 REJECT     all  --  wlan0  wlan0   0.0.0.0/0            0.0.0.0/0            reject-with icmp-port-unreachable

Chain OUTPUT (policy ACCEPT 721 packets, 115K bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain f2b-sshd (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 REJECT     all  --  *      *       212.83.191.97        0.0.0.0/0            reject-with icmp-port-unreachable
    0     0 REJECT     all  --  *      *       212.129.6.17         0.0.0.0/0            reject-with icmp-port-unreachable
    0     0 REJECT     all  --  *      *       198.11.246.172       0.0.0.0/0            reject-with icmp-port-unreachable
    0     0 REJECT     all  --  *      *       193.104.41.54        0.0.0.0/0            reject-with icmp-port-unreachable
  803 69528 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0

#ifconfig

eth0      Link encap:Ethernet  HWaddr XXXXXXXXXXXXXXXXXXXX
          inet addr:192.168.1.3  Bcast:192.168.1.255  Mask:255.255.255.0
          inet6 addr: XXXXXXXXXXXXXXXXXXXXXXX/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:1271 errors:0 dropped:0 overruns:0 frame:0
          TX packets:877 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:131595 (131.5 KB)  TX bytes:150077 (150.0 KB)
          Interrupt:20 Memory:f7100000-f7120000

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:229 errors:0 dropped:0 overruns:0 frame:0
          TX packets:229 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:16828 (16.8 KB)  TX bytes:16828 (16.8 KB)

wlan0     Link encap:Ethernet  HWaddr XXXXXXXXXXXXXXXXX
          inet addr:192.168.2.100  Bcast:192.168.2.255  Mask:255.255.255.0
          inet6 addr: XXXXXXXXXXXXXXXXXXXXX/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:222 errors:0 dropped:0 overruns:0 frame:0
          TX packets:266 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:12115 (12.1 KB)  TX bytes:26066 (26.0 KB)

#lspci

00:19.0 Ethernet controller [0200]: Intel Corporation Ethernet Connection (3) I218-V [8086:15a3] (rev 03)
        Subsystem: Intel Corporation Device [8086:2057]
        Kernel driver in use: e1000e

02:00.0 Network controller [0280]: Intel Corporation Wireless 7265 [8086:095a] (rev 59)
        Subsystem: Intel Corporation Dual Band Wireless-AC 7265 [8086:9010]
        Kernel driver in use: iwlwifi

That should be everything I can think of needed for debugging. I greatly appreciate your time in advance.

  • While there is much information given, what would be the question actually? Should clarify the question i.e. "How to connect to the internet for [WHAT] configuration" or "How to connect using [WHICH] device?" – clearkimura Jan 3 '16 at 8:31
  • Thanks clearkimura, I have a edited the post to actually asking a question. – Jeff Ausfeld Jan 3 '16 at 12:15
0

iptables was getting in the way. I am not entirely sure where. The nice part is you do not need iptables for this setup. UFW can do all of this directly.

apt-get remove --purge iptables

NOTE: THIS -- PURGE COMMAND WILL ALSO COMPLETELY REMOVE UFW ALONG WITH ANY OTHER REFERENCE PACKAGE TO IPTABLES INCLUDING ALL *.CONF FILES SAVE EVERYTHING YOU WANT TO KEEP IN NEW FILES -- THIS IS THE BIG RED RESET BUTTON -- USE WITH EXTREME CAUTION

apt-get install ufw
ufw allow ssh

Edit the following config files:

/etc/ufw/sysctl.conf:

uncomment net/ipv4/ip_forward=1 on line 8

/etc/ufw/before.rules: Place the following AFTER the last COMMIT in the file or you will get *filter errors. Remember to add another COMMIT after the masquerade block shown below or nothing will happen!

#NAT rules
*nat
:POSTROUTING ACCEPT [0:0]

# Forward traffic through eth0 - Change to match your out-interface
-A POSTROUTING -s 192.168.2.0/24 -o eth0 -j MASQUERADE

COMMIT

UFW rules:

ufw route allow in on wlan0 out on eth0 from 192.168.2.0/24

/etc/dhcp/dhcpd.conf:

ddns-update-style none;
option domain-name-servers 192.168.1.1;
default-lease-time 600;
max-lease-time 7200;
authoritative;
log-facility local7;

# wlan0
subnet 192.168.2.0 netmask 255.255.255.0 {
  range 192.168.2.2 192.168.2.51;
  option routers 192.168.2.1;
}

/etc/network/interfaces:

# The loopback network interface
auto lo
iface lo inet loopback

# Wired LAN
allow-hotplug eth0
iface eth0 inet dhcp

# Wireless Users
allow-hotplug wlan0
iface wlan0 inet static
    address 192.168.2.100
    netmask 255.255.255.0
    broadcast 192.168.2.255

Delete or comment out everything related to this subject matter in /etc/rc.local other than exit 0.

/etc/default/isc-dhcp-server:

INTERFACES="wlan0"

/etc/sysctl.conf: You can comment out everything here. Many of the instructions have you uncomment "net.ipv4.ip_forward=1". We have already turned this on in /etc/ufw/sysctl.conf and it is no longer needed here.

/etc/default/hostapd:

DAEMON_CONF="/etc/hostapd/hostapd.conf"

/etc/hostapd/hostapd.conf:

interface=wlan0
driver=nl80211
country_code=US
ssid=YYYYYYYY
hw_mode=g
channel=6
wpa=2
wpa_passphrase=XXXXXXXX

Enable UFW

ufw enable

Reboot server for changes to take effect

reboot

Check if all is working well: wlan0 should be broadcasting on ssid specified, allowing users via the passphrase specified, issuing dhcp address in the range specified, and allowing those same users access to the internet over eth0. Further if you run "ufw status" It will look like the following:

Status: active

To                         Action      From
--                         ------      ----
22                         ALLOW       Anywhere
22 (v6)                    ALLOW       Anywhere (v6)

Anywhere on eth0           ALLOW FWD   192.168.2.0/24 on wlan0

I hope this helps some of you as there are many different instructions for how to complete this step and I ran into just as many problems trying to follow them.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.