0

I have a Raspberry Pi in remote operation for several purposes.

The RPI will operate with an reverse VPN over either wlan1 or eth1 , the setup was done according following page: https://www.rustimation.eu/index.php/re ... r-schritt/ eth1 is already prepared for future demand, because wlan1 will not be available in foreseeable future. Both internet access possibilities are controlled by metric command.

Furthermore, I will realize a port forwarding from eth1 to wlan0 the have a WIFI internet access. The port forwarding (internet access) I would like to realize with nftables command, because a future support of iptables is uncertain. Unfortunately I have problems to realize the port forwarding with nftables command. I already read a lot of pages, without success. I'm able to connect wlan0, but without internet access. Either wlan1 or eth1 are on air with internet access.

Hardware: RPI3 with Buster eth1 LTE Modem WLAN0 (intern) and wlan1 (USB Stick) ETH0 temporarly connected

/etc/network/interfaces

# interfaces(5) file used by ifup(8) and ifdown(8)

# Please note that this file is written to be used with dhcpcd
# For static IP, consult /etc/dhcpcd.conf and 'man dhcpcd.conf'

# Include files from /etc/network/interfaces.d:
source-directory /etc/network/interfaces.d

#loopback adapter
auto lo
iface lo inet loopback

#wired adapter
iface eth0 inet dhcp

allow-hotplug wlan0
iface wlan0 inet static
address 192.168.1.100
netmask 255.255.255.0
network 192.168.1.0
broadcast 192.168.1.255

allow-hotplug wlan1
iface wlan1 inet dhcp
wpa-conf /etc/wpa_supplicant/wpa_supplicant_wlan1.conf

allow-hotplug eth1
iface eth1 inet dhcp

In folder /etc/network/interfaces.d are 4 files present

eth0 (not important)

eth1

allow-hotplug eth1
auto eth1
iface eth1 inet dhcp

wlan0

allow-hotplug wlan0
iface wlan0 inet static
address 192.168.1.100
netmask 255.255.255.0

wlan1 (not important)

wpa_supplicant_wlan1:

ctrl_interface=DIR=/var/run/wpa_supplicant GROUP=netdev
update_config=1
country=DE

network={
ssid="XXX"
psk="XXX"

The following setup was done according https://www.randombrick.de/raspberry-pi ... nt-nutzen/

For wlan0 AP, hostapd.conf was created:

# Der Name des WLAN Interface das hier konfiguriert wird
interface=wlan0

# Verwendung des nl80211 Treibers mit dem brcmfmac Treiber
driver=nl80211

# Der sichtbare WLAN-Name
ssid=XXXY

# Vewende das 2,4 GHz Band
hw_mode=g

# Verwende Kanal 6
channel=7

# Aktiviere 802.11n
ieee80211n=1

# Aktiviere WMM
wmm_enabled=1

# Nutze 40MHz Frequenzen mit 20ns Sicherheitsintervall
ht_capab=[HT40][SHORT-GI-20][DSSS_CCK-40]

# Akzeptiere alle MAC Adressen
macaddr_acl=0

# Verwende WPA Authentifizierung
auth_algs=1

# Klienten müssen den Namen des Netzwerks nicht kennen
#ignore_broadcast_ssid=0

# Verwende WPA2
wpa=2

# Verwende einen Pre-shared Key
wpa_key_mgmt=WPA-PSK

# Das WLAN-Passwort
wpa_passphrase=XXX

# Verwende AES anstatt TKIP
rsn_pairwise=CCMP

Dnsmasq was created:

# Das zu nutzende Interface
interface=wlan0

# Die IP-Adresse über die der DNS zuhört
listen-address=127.0.0.1
bind-interfaces
#bind-dynamic

# Weiterleitung von DNS Anfragen an den Google DNS
server=8.8.8.8

# Kurznamen werden nicht weitergeleitet
domain-needed
bogus-priv

# Der DHCP-Server verteilt Adressen im Adressbereich zwischen 192.168.0.50 und $
dhcp-range=192.168.1.110,192.168.1.150,240h

Wlan0 is on air, I'm able to connect with estimated IP.

The port forwarding from eth1 to wlan0 and in opposite direction is realized with nftables.conf:

table inet filter {
chain input {
type filter hook input priority 0; policy drop;
iif "lo" accept
iif "wlan0" jump wlan
iif "eth1" jump wan
}

chain forward {
type filter hook forward priority 0; policy drop;
iif "wlan0" jump wlan
iif "eth1" jump wan
}

chain output {
type filter hook output priority 0; policy accept;
}

chain wlan {
accept
}

chain wan {

ct state vmap { invalid : drop, established : accept, related :$
ip protocol icmp icmp type { echo-reply, destination-unreachabl$
pkttype { broadcast, multicast } return
log prefix "dropped packet"
}
}
table ip nat {
chain prerouting {
type nat hook prerouting priority 0; policy accept;
}

chain postrouting {
type nat hook postrouting priority 0; policy accept;
oif "wlan0" masquerade
}
}

I assume, in nftables.conf is the mistake!?? Can you please give me some clues?

ip a

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever

2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
link/ether b8:27:eb:9f:24:85 brd ff:ff:ff:ff:ff:ff
inet 192.168.198.29/24 brd 192.168.198.255 scope global dynamic eth0
valid_lft 814601sec preferred_lft 814601sec
inet6 fe80::ba27:ebff:fe9f:2485/64 scope link
valid_lft forever preferred_lft forever

3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN group default qlen 1000
link/ether 0c:5b:8f:27:9a:64 brd ff:ff:ff:ff:ff:ff
inet 192.168.8.100/24 brd 192.168.8.255 scope global dynamic eth1
valid_lft 71809sec preferred_lft 71809sec
inet6 fe80::e5b:8fff:fe27:9a64/64 scope link
valid_lft forever preferred_lft forever

4: wlan0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
link/ether b8:27:eb:ca:71:d0 brd ff:ff:ff:ff:ff:ff
inet 192.168.1.100/24 brd 192.168.1.255 scope global wlan0
valid_lft forever preferred_lft forever
inet6 fe80::ba27:ebff:feca:71d0/64 scope link
valid_lft forever preferred_lft forever

5: wlan1: <BROADCAST,MULTICAST> mtu 1500 qdisc mq state DOWN group default qlen 1000
link/ether 74:da:38:5d:e6:d3 brd ff:ff:ff:ff:ff:ff
inet 192.168.198.39/24 brd 192.168.198.255 scope global dynamic wlan1
valid_lft 814608sec preferred_lft 814608sec

ip r

default via 192.168.8.1 dev eth1
192.168.1.0/24 dev wlan0 proto kernel scope link src 192.168.1.100
192.168.8.0/24 dev eth1 proto kernel scope link src 192.168.8.100
192.168.198.0/24 dev eth0 proto kernel scope link src 192.168.198.29

Thanks in advance.

Andreas

  • The internal configuration is well documented but it is difficult to see for what this is used. There are several interfaces but not all are routed. Do you really still want to use deprecated /etc/network/interfaces? Are you open to use systemd-networkd? – Ingo May 4 at 19:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.