I'm using my Raspberry Pi in headless mode (through ssh) and I want to set it up as a wireless access point.

But if, acting as an access point, it forwards packets from the ethernet interface onto the wlan interface and vice versa, does that mean I will not be able to control it through ssh (since my ssh traffic that lands on the ethernet interface gets forwarded directly to wlan) ?

Forwarding as follows:

iptables -A FORWARD -i eth0 -o wlan0
iptables -A FORWARD -i wlan0 -o eth0
| improve this question | | | | |
  • Have you tried? – Jaromanda X Aug 14 '19 at 23:13
  • Yes, but it results in me having to connect to my Pi's wireless access point on whatever computer I want to talk to it through ssh. I don't want to have to do this. I would like the controlling computer to be connected to another network. – Ciarán Aug 15 '19 at 8:54
  • That's the iptables rule you need iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE. – jake Aug 15 '19 at 11:53
  • -j MASQUERADE for an access point, @jake? – Jaromanda X Aug 15 '19 at 22:45
  • @JaromandaX What the OP seems to want is rather a repeater, otherwise there would be no need to forward anything, would it? – jake Aug 15 '19 at 22:57

To answer your immediate question, packets land in the FORWARD chain after the local routing decision is taken, so packets addressed to the RPi itself (like SSH traffic) should not be affected by these rules:

enter image description here

However, you should note that if eth0 and wlan0 interfaces belong to different IP subnets (e.g. 192.168.0.X and 192.168.1.X), simply forwarding packets between the two interfaces will not be enough to insure proper routing. You'll need that -j MASQUERADE option mentioned in the comments to make sure source addresses of IP packets are properly modified to make the replies routable. And since FORWARD chain doesn't allow packets to be modified, you'll have to enable NAT and use POSTROUTING chain to do this.

If you're happy with your current routing rules, I think you need to at least add a -j ACCEPT to make bare forwarding work.

| improve this answer | | | | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.