I'm using Libreelec on a RPi3 and I would like to use it to route between eth0 and wlan0 too.
- Network A - 192.168.0.0/24 with Internet access, connected to eth0, my network
- Network B - 192.168.1.0/24 with Internet access, connected to wlan0, friend's network
Basically I would like to "merge" the two networks with the Pi, so I can access my friend's network (just for file sharing directly, not for Internet access) and he can access mine whenever the Pi is switched on. Consider these sample devices:
- Router_A = IP 192.168.0.1 + DHCP server (192.168.0.50-250) + Static route (192.168.1.0 MASK 255.255.255.0 192.168.0.112 METRIC 2)
- PC_A = IP 192.168.0.77 (reseved on DHCP of Router_A), received default gateway 192.168.0.1
- RPi eth0 = IP 192.168.0.112 (reserved on DHCP of Router_A), received default gateway 192.168.0.1
- RPi wlan0 = IP 192.168.1.253 (reserved on DHCP of Router_B), doesn't seem to receive the default gateway even though Router_B provides it (and this should be correct, as eth0 is primary, right?)
- PC_B = IP 192.168.1.99 (reserved on DHCP of Router_B), received default gateway 192.168.1.1 + Static route (192.168.0.0 MASK 255.255.255.0 192.168.1.253 METRIC 2)
- Router_B = IP 192.168.1.1 + DHCP server (192.168.1.50-250), doesn't handle static routes so I had to add one to PC_B
After connecting to my RPi via SSH and typing these commands (read from here):
LibreELEC:~/downloads # echo 1 > /proc/sys/net/ipv4/ip_forward LibreELEC:~/downloads # iptables -F LibreELEC:~/downloads # iptables -X LibreELEC:~/downloads # iptables -t nat -F LibreELEC:~/downloads # iptables -t nat -X LibreELEC:~/downloads # iptables -t nat -A POSTROUTING -o wlan0 -j MASQUERADE
... from PC_A and every other device on the network A I'm able to ping and connect to any PC or device on network B.
My issue is that the reverse is not true: from PC_B I can't ping PC_A or Router_A, only RPI wlan0. But PC_B has the static route added manually! Of course from the RPi via SSH I can ping any device on both networks.
What's wrong? I'm pretty sure something in iptables is missing, but I'm unable to figure out what, in particular.
NOTE: I don't need NAT specifically, this is the only setup that I've found working at the moment.
After Ingo answered, I learned the following which may be useful for future readers:
- The configuration was correct and only the ip_forward setting is necessary to make it work. NAT masquerade (last command) is not required.
- If from RPi you're not able to ping PC_B check that the firewall has the correct rule on PC_B or disable the firewall.
- Even after allowing ping on the firewall (previous point), from PC_A you won't be able to ping PC_B (but RPi will ping PC_B). However, if from PC_A you try to reach a port opened on PC_B (such as a webserver) it will work; ping is not working due to the firewall of PC_B (if you disable it, ping will work too). Alternatively, you can enable NAT masquerading (last command) and in this way PC_A will ping PC_B even without disabling the firewall.
- When creating the manual static route on PC_B it doesn't matter if the priority number in
route printis higher than the gateway route on Windows 10. It's just a visualization (wrong in my opinion).
- My issues were caused by something on Network B that I haven't identified yet (see comments below).